diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c b/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c
index 2983bd021..36778de16 100644
--- a/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c
@@ -20,6 +20,7 @@
 
 #define AVP_EAP_MESSAGE		79
 #define AVP_HEADER_LEN		 8
+#define AVP_LENGTH_MAX		 UINT16_MAX
 
 typedef struct private_eap_ttls_avp_t private_eap_ttls_avp_t;
 
@@ -119,7 +120,7 @@ METHOD(eap_ttls_avp_t, process, status_t,
 		chunk_free(&this->input);
 		this->inpos = 0;
 
-		if (!success || avp_len < AVP_HEADER_LEN)
+		if (!success || avp_len < AVP_HEADER_LEN || avp_len > AVP_LENGTH_MAX)
 		{
 			DBG1(DBG_IKE, "received invalid AVP header");
 			return FAILED;