Currently the rpc-server doesn't perform any input validation and this may have security implications. Another problem is that it may create memory leaks if clients do not free allocated buffers before disconnect (PR #7378 tries to address this).
I think we can address both issues by using std::unordered_set to track allocated buffers and perform some additional checks without any noticeable performance degradation.