They both will take the same amount of memory. The issue here is the lifespan. Requests are short lived, and as soon as the request has finished its attributes can be cleaned up immediately. Sessions on the other hand can be active for hours at a time, all the while its attributes are kept in memory.
You should therefore use request attributes unless you need them between multiple requests from the same user; a session is the only option in those cases.
As for your memory problem, sometimes web applications simply need a lot of memory, more than your
servlet container (
Tomcat?) can provide. If this is the case, try increasing the memory the servlet container can use instead.
