The "HTTPDecoder" in "NIOHTTP1" enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting "HTTPHeaders" value before any application code runs. This can be used to exhaust memory, or — for consumers that subsequently convert headers into "swift-http-types"' "HTTPFields" — to crash the process.