Security issue in Java based server

[worktycho]

Well since we limit packet size to 32 KiB I suggest 512 KiB as a limit. Most non-pathological structured data has a less than 10:1 compression ratio so having a limit of 16 times compressed size seems reasonable. Limiting this in the NBT parser could be as simple as limiting the size of cFastNBT::m_Tags to a sensible value. Can I suggest 1,000?

Recursion depth for NBT was more of a general issue as if you can jump the guard page it allows the attacker to write arbitrary data to memory.