diff --git a/src/mux_h2.c b/src/mux_h2.c
index dc67bc673..20ff98821 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3316,6 +3316,11 @@ static int h2c_decode_headers(struct h2c *h2c, struct buffer *rxbuf, uint32_t *f
 			goto fail;
 		}
 
+		if (flen < 5) {
+			h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR);
+			goto fail;
+		}
+
 		hdrs += 5; // stream dep = 4, weight = 1
 		flen -= 5;
 	}