It isn't a matter of memory usage; the memory usage is still linear in the size of the input regardless of the depth. If an attacker can get you to oom by feedi

It isn't a matter of memory usage; the memory usage is still linear in the size of the input regardless of the depth. If an attacker can get you to oom by feeding you a deeply nested data structure, they can do the same with a shallow one just as easily: "[0, 0, 0, 0, 0, <...gigabytes of zeros>, 0 0, 0, 0]" So you need to limit the overall input size regardless of whether you already have a depth limit in place.