diff --git a/lib/dns/rdata/generic/nsec3_50.c b/lib/dns/rdata/generic/nsec3_50.c
index f45fe4dc33..e04587bd1b 100644
--- a/lib/dns/rdata/generic/nsec3_50.c
+++ b/lib/dns/rdata/generic/nsec3_50.c
@@ -324,6 +324,7 @@ tostruct_nsec3(ARGS_TOSTRUCT) {
 	}
 
 	nsec3->mctx = mctx;
+
 	return ISC_R_SUCCESS;
 
 cleanup:
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 809b7be911..9ec13581ab 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -339,6 +339,9 @@ trynsec3:
 			if (nsec3.hash != 1) {
 				continue;
 			}
+			if (nsec3.next_length > NSEC3_MAX_HASH_LENGTH) {
+				continue;
+			}
 			length = isc_iterated_hash(
 				hash, nsec3.hash, nsec3.iterations, nsec3.salt,
 				nsec3.salt_length, name->ndata, name->length);