The memory pool holds unconfirmed transactions in RAM. It seems that memory pool storage could overflow if no block is solved for a very long time and many transactions are published within a short interval.
In browsing the source code, I found no mention of a cap on the memory pool size:
Does such a cap exist? If not, couldn't an attacker use the unbounded size of the memory pool to overflow the RAM of a large number of nodes, knocking them offline?
I noticed two proposals that seemed to address this issue, but neither has made it through the approval process: