I'm not sure if this is to be reported for dbus, but I hope so.
When I create a simple server interface for org.freedesktop.Notifications (in my case in vala) and just pass the new id for the Notify method, so not showing anything or using the data, I quickly get 100mb of memory usage for this simple program, especially for notifications by music players which do also pass cover art.
I don't think I do anything wrong about freeing the passed memory, since it is done automatically in vala.
Ubuntu's Notify-OSD seems to have a similar problem: http://bazaar.launchpad.net/~canonical-dx-team/notify-osd/precise/view/head:/src/stack.c#L778 (see the comment), although I'm not fully sure if it is the same thing.
Do I have to free that data manually in some way or is this a bug in dbus?
It might be a Vala binding fault, which means it could be a gdbus fault. Either way, it's not a D-Bus core library fault and gdbus isn't tracked on this bugtracker.