Add limitation to NBT data, we'll stick with this for now. I don't see this easily being beaten.

src/main/java/us/myles/ViaVersion/util/PacketUtil.java

@@ -42,6 +42,9 @@ public class PacketUtil {
     }
 
     public static CompoundTag readNBT(ByteBuf input) throws IOException {
+        // Default client is limited to 2097152 bytes. (2.09mb)
+        Preconditions.checkArgument(input.readableBytes() <= 2097152, "Cannot read NBT (got %s bytes)", input.readableBytes());
+
         int readerIndex = input.readerIndex();
         byte b = input.readByte();
         if (b == 0) {