diff --git a/src/pem.c b/src/pem.c
index a3d212fd..18c091b5 100644
--- a/src/pem.c
+++ b/src/pem.c
@@ -383,6 +383,8 @@ out:
 #define OPENSSH_PRIVKEY_FOOTER     "-----END OPENSSH PRIVATE KEY-----"
 #define OPENSSH_PRIVKEY_AUTH_MAGIC "openssh-key-v1"
 
+#define SSH2_KDF_ROUNDS_MAX  (1 << 20)
+
 static int pem_parse_data_openssh(LIBSSH2_SESSION *session,
                                   const char *passphrase,
                                   const char *b64data, size_t b64datalen,
@@ -546,6 +548,12 @@ static int pem_parse_data_openssh(LIBSSH2_SESSION *session,
                 goto out;
             }
 
+            if(rounds > SSH2_KDF_ROUNDS_MAX) {
+                ret = ssh2_err(session, LIBSSH2_ERROR_PROTO,
+                               "Too many KDF rounds");
+                goto out;
+            }
+
             if(ssh2_bcrypt_pbkdf(passphrase, strlen(passphrase),
                                  salt, salt_len, key,
                                  keylen + ivlen, rounds) < 0) {