diff --git a/src/flb_zstd.c b/src/flb_zstd.c
index 116fee2158f..2c59eb0c20e 100644
--- a/src/flb_zstd.c
+++ b/src/flb_zstd.c
@@ -28,7 +28,8 @@ struct flb_zstd_decompression_context {
     ZSTD_DCtx *dctx;
 };
 
-#define FLB_ZSTD_DEFAULT_CHUNK 64 * 1024  /* 64 KB buffer */
+#define FLB_ZSTD_DEFAULT_CHUNK      (64 * 1024)       /* 64 KB buffer */
+#define FLB_ZSTD_DECOMPRESS_MAX     (100 * 1024 * 1024)  /* 100 MB limit */
 
 int flb_zstd_compress(void *in_data, size_t in_len, void **out_data, size_t *out_len)
 {
@@ -104,7 +105,16 @@ static int zstd_uncompress_unknown_size(void *in_data, size_t in_len, void **out
 
         /* check if we need more space */
         if (output.pos == out_size) {
+            if (out_size >= FLB_ZSTD_DECOMPRESS_MAX) {
+                flb_error("[zstd] maximum decompression size reached (~100 MB)");
+                flb_free(buf);
+                ZSTD_freeDCtx(dctx);
+                return -1;
+            }
             out_size *= 2;
+            if (out_size > FLB_ZSTD_DECOMPRESS_MAX) {
+                out_size = FLB_ZSTD_DECOMPRESS_MAX;
+            }
             tmp = flb_realloc(buf, out_size);
             if (!tmp) {
                 flb_errno();
@@ -146,6 +156,12 @@ int flb_zstd_uncompress(void *in_data, size_t in_len, void **out_data, size_t *o
         return ret;
     }
 
+    if (size > FLB_ZSTD_DECOMPRESS_MAX) {
+        flb_error("[zstd] maximum decompression size is %d bytes",
+                  FLB_ZSTD_DECOMPRESS_MAX);
+        return -1;
+    }
+
     buf = flb_malloc(size);
     if (!buf) {
         flb_errno();