ModeShape uses an transient, local Infinispan cache for each of the repository's workspaces to hold data in memory and make it quickly available to running sessions. Clients can always define a custom configuration for this cache but since this is an advanced feature, ModeShape relies on a default configuration which should be used (presumably) for all workspaces.
For this cache to perform well, it's essential that it has both eviction and expiration enabled, bounding the maximum number of items that can be loaded in memory.

In Infinispan 5 and 6 (embedded) one would define a default configuration for all the caches of a cache container like so:

   <default>
        <!-- Local in-memory caches with no persistence. -->
        <clustering mode="LOCAL"/>

        <!-- No more that 10K entries per cache, with LIRS eviction. -->
        <eviction maxEntries="10000" strategy="LIRS"/>

        <!-- Expire entries after 120 seconds or after 60 seconds of not being used (whichever comes first). -->
        <expiration lifespan="120000" maxIdle="60000"/>
    </default>

With the above configuration, when requesting a cache instance which is not explicitly defined, one would get back a new cache configured with the above defaults.

However, in the EAP/WF subsystem, ModeShape has a couple of bugs which prevent this from working correctly:
1) the default-workspace-cache-config.xml file is not loaded correctly
2) if a user defines an explict WS cache container configuration, the above "defaults" style of configuration do not work for EAP/WF which, if a cache is not defined in a cache-container it will return an in memory default cache, without any eviction or expiration.

This means that OOMs are pretty likely to occur in any real system, since the WS cache will grow endlessly.