You can make an app OOM by setting big string values anywhere. You gotta handle that at a higher level and reject requests larger than a certain size, which there is already a default for.

I spent a good amount of time trying to find some gadgets on jdk8 today no dice besides some DoS