diff --git a/src/tls.c b/src/tls.c
index ebd5cbac3..be48737fa 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -7935,7 +7935,8 @@ static int TLSX_PreSharedKey_Parse(WOLFSSL* ssl, byte* input, word16 length,
             /* Length of identity. */
             ato16(input + idx, &identityLen);
             idx += OPAQUE16_LEN;
-            if (len < OPAQUE16_LEN + identityLen + OPAQUE32_LEN)
+            if (len < OPAQUE16_LEN + identityLen + OPAQUE32_LEN ||
+                    identityLen > MAX_PSK_ID_LEN)
                 return BUFFER_E;
             /* Cache identity pointer. */
             identity = input + idx;
@@ -9585,6 +9586,11 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
                 WOLFSSL_SESSION* sess = &ssl->session;
                 word32           milli;
 
+                if (sess->ticketLen > MAX_PSK_ID_LEN) {
+                    WOLFSSL_MSG("Session ticket length for PSK ext is too large");
+                    return BUFFER_ERROR;
+                }
+
                 /* Determine the MAC algorithm for the cipher suite used. */
                 ssl->options.cipherSuite0 = sess->cipherSuite0;
                 ssl->options.cipherSuite  = sess->cipherSuite;
diff --git a/src/tls13.c b/src/tls13.c
index cbf8628bf..3037caca2 100644
--- a/src/tls13.c
+++ b/src/tls13.c
@@ -3378,6 +3378,9 @@ static int DoPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 helloSz,
     #endif
 
     #ifndef NO_PSK
+        if (current->identityLen > MAX_PSK_ID_LEN) {
+            return BUFFER_ERROR;
+        }
         XMEMCPY(ssl->arrays->client_identity, current->identity,
                 current->identityLen);
         ssl->arrays->client_identity[current->identityLen] = '\0';
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index c657f299c..3683120e2 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -1173,7 +1173,12 @@ enum Misc {
     HELLO_EXT_EXTMS = 0x0017,   /* ID for the extended master secret ext */
     SECRET_LEN      = WOLFSSL_MAX_MASTER_KEY_LENGTH,
                                 /* pre RSA and all master */
+
+#if defined(WOLFSSL_TLS13)
+    MAX_PSK_ID_LEN     = 256,  /* max psk identity/hint supported */
+#else
     MAX_PSK_ID_LEN     = 128,  /* max psk identity/hint supported */
+#endif
 #if defined(WOLFSSL_MYSQL_COMPATIBLE) || \
     (defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS > 8192)
 #ifndef NO_PSK