{"record":{"id":"58976eaf97c1e779","repo":"Pumpkin-MC/Pumpkin","slug":"nbt-depth-exceeded-maximum-allowed-limit","errorCode":null,"errorMessage":"NBT depth exceeded maximum allowed limit","messagePattern":"NBT depth exceeded maximum allowed limit","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-nbt/src/lib.rs","lineNumber":107,"sourceCode":"    #[error(\"NBT doesn't support this type: {0}\")]\n    UnsupportedType(String),\n    /// The underlying reader or writer returned an I/O error.\n    #[error(\"NBT reading was cut short: {0}\")]\n    Incomplete(io::Error),\n    /// A list or array declared a negative element count.\n    #[error(\"Negative list length: {0}\")]\n    NegativeLength(i32),\n    /// A string, list, or array exceeded the supported length.\n    #[error(\"Length too large: {0}\")]\n    LargeLength(usize),\n    /// A Bedrock variable-length integer exceeded its maximum encoded size.\n    #[error(\"Failed to decode varint - value too large\")]\n    VarIntTooLarge,\n    /// A Bedrock variable-length long exceeded its maximum encoded size.\n    #[error(\"Failed to decode varlong - value too large\")]\n    VarLongTooLarge,\n    /// NBT nesting depth exceeded the maximum allowed limit.\n    #[error(\"NBT depth exceeded maximum allowed limit\")]\n    MaxDepthExceeded,\n    /// A list tag specified an invalid element tag type.\n    #[error(\"Invalid element tag type for list: {0}\")]\n    InvalidListTag(u8),\n}\n\n/// A complete NBT document containing a named root compound.\n#[derive(Clone, Debug, Default, PartialEq)]\npub struct Nbt {\n    /// Name stored alongside the root compound.\n    pub name: String,\n    /// Root compound containing the document's tags.\n    pub root_tag: NbtCompound,\n}\n\nimpl Nbt {\n    /// Creates a document from a root name and compound.\n    #[must_use]","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-nbt/src/lib.rs#L89-L125","documentation":"NBT decode guard against malicious or corrupted nesting: recursive NBT compounds/lists were nested deeper than the decoder's maximum allowed depth while deserializing. It fires before stack exhaustion, protecting against deeply nested payloads crafted by a bad client or damaged chunk data. The offending input is the nested tag structure of the NBT payload itself.","triggerScenarios":"Deserializing NBT with more nested TAG_Compound/TAG_List levels than the configured maximum depth.","commonSituations":"Malicious 'NBT bombs' crafted by clients, recursively structured plugin data, or accidentally nested serializers writing compound-in-compound repeatedly.","solutions":["Reject the NBT payload as invalid","Keep a depth counter while deserializing and bail early","Log the depth violation at debug level"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fn depth_ok(nbt_bytes: &[u8], max_depth: usize) -> bool { count_max_nesting(nbt_bytes) <= max_depth }","typeGuard":null,"tryCatchPattern":"match result { Err(Error::MaxDepthExceeded) => reject_payload_as_malicious(), Ok(v) => use(v), Err(e) => propagate(e) }","preventionTips":["Limit nesting depth at the producer side","Reject untrusted payloads with tight depth limits","Add fuzz tests with deeply nested compounds"],"tags":["nbt","recursion","depth-limit","security"],"backgroundTag":"value-out-of-range","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}