This all is assuming that no-one has found the vulnerability before. My understanding is that, once you figure out what kind of request causes the overflow, you can pretty much just spam CF with it, getting new garbage data every time. If someone was deliberately doing that, they could have more data than all the indexes combined. And the worst part is that we'll never know.