diff -ruN libssh2-1.11.1.orig/src/transport.c libssh2-1.11.1/src/transport.c
--- libssh2-1.11.1.orig/src/transport.c	2024-10-16 09:03:21.000000000 +0100
+++ libssh2-1.11.1/src/transport.c	2026-06-22 13:40:44.786615150 +0100
@@ -639,8 +639,13 @@
                 total_num = 4;
 
                 p->packet_length = _libssh2_ntohu32(block);
-                if(p->packet_length < 1)
+               if(p->packet_length < 1) {
                     return LIBSSH2_ERROR_DECRYPT;
+	       }
+		
+                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
+                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+                }
 
                 /* total_num may include size field, however due to existing
                  * logic it needs to be removed after the entire packet is read