Boa up to and including 0.94.14rc21 allows remote malicious users to trigger a memory leak because of missing calls to the free function.
boa boa