If the serialized data is provided by an untrusted client, it can be manipulated.
Let's assume there is a linked list. The attacker can add a huge number of entries.
It may even be possible to created invalid serialized data. For example the length field of an array can be set to a very huge number. The server will allocate enough memory to store all elements, although they are never sent.
In some circumstances it is possible to trigger code that allocates other resources such as threads or files.
Last but not least there have been classes with bugs in their serialization code.