Serialized transaction bigger than the actual transaction object? CVE-2013-4627
Yes. The attack was adding junk to the end of otherwise valid transactions to cause the junk to get relayed around. (as an aside, if we hadn't fixed that, segwit would have been easier to deploy...)