Pumpkin-MC/Pumpkin · error · Error

NBT depth exceeded maximum allowed limit

Error message

NBT depth exceeded maximum allowed limit

What it means

NBT decode guard against malicious or corrupted nesting: recursive NBT compounds/lists were nested deeper than the decoder's maximum allowed depth while deserializing. It fires before stack exhaustion, protecting against deeply nested payloads crafted by a bad client or damaged chunk data. The offending input is the nested tag structure of the NBT payload itself.

Solutions

1. Reject the NBT payload as invalid
2. Keep a depth counter while deserializing and bail early
3. Log the depth violation at debug level

fn depth_ok(nbt_bytes: &[u8], max_depth: usize) -> bool { count_max_nesting(nbt_bytes) <= max_depth }

match result { Err(Error::MaxDepthExceeded) => reject_payload_as_malicious(), Ok(v) => use(v), Err(e) => propagate(e) }

When it happens

Trigger: Deserializing NBT with more nested TAG_Compound/TAG_List levels than the configured maximum depth.

Common situations: Malicious 'NBT bombs' crafted by clients, recursively structured plugin data, or accidentally nested serializers writing compound-in-compound repeatedly.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• JWT chain validation failed
• Cannot accept self-signed token. Authentication is enforced…
• Failed to verify Ed25519 signature
• Vine timestamp expired or desynchronized: skew of
• Vine challenge nonce mismatch

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/58976eaf97c1e779. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-nbt/src/lib.rs:107

    #[error("NBT doesn't support this type: {0}")]
    UnsupportedType(String),
    /// The underlying reader or writer returned an I/O error.
    #[error("NBT reading was cut short: {0}")]
    Incomplete(io::Error),
    /// A list or array declared a negative element count.
    #[error("Negative list length: {0}")]
    NegativeLength(i32),
    /// A string, list, or array exceeded the supported length.
    #[error("Length too large: {0}")]
    LargeLength(usize),
    /// A Bedrock variable-length integer exceeded its maximum encoded size.
    #[error("Failed to decode varint - value too large")]
    VarIntTooLarge,
    /// A Bedrock variable-length long exceeded its maximum encoded size.
    #[error("Failed to decode varlong - value too large")]
    VarLongTooLarge,
    /// NBT nesting depth exceeded the maximum allowed limit.
    #[error("NBT depth exceeded maximum allowed limit")]
    MaxDepthExceeded,
    /// A list tag specified an invalid element tag type.
    #[error("Invalid element tag type for list: {0}")]
    InvalidListTag(u8),
}

/// A complete NBT document containing a named root compound.
#[derive(Clone, Debug, Default, PartialEq)]
pub struct Nbt {
    /// Name stored alongside the root compound.
    pub name: String,
    /// Root compound containing the document's tags.
    pub root_tag: NbtCompound,
}

impl Nbt {
    /// Creates a document from a root name and compound.
    #[must_use]

View on GitHub (pinned to 8d4639e25a)