If you can make your service allocate 10G of memory, it's already a denial of service attack.

Usually unexpected exception results in a HTTP 500 response (or something similar) and few lines in the log. It does not result in stopped server.

It's an exception, not a crash.