Boa up to and including 0.94.14rc21 allows remote malicious users to trigger an out-of-memory (OOM) condition because malloc is mishandled.
boa boa