diff --git a/ChangeLog.d/serialized-data-load-hardening.txt b/ChangeLog.d/serialized-data-load-hardening.txt
new file mode 100644
index 0000000000..e068988dac
--- /dev/null
+++ b/ChangeLog.d/serialized-data-load-hardening.txt
@@ -0,0 +1,5 @@
+Bugfix
+   * Reject malformed TLS 1.3 serialized sessions instead of accepting
+     unterminated strings or extra trailing data.
+   * Reject serialized SSL contexts whose DTLS Connection ID length exceeds
+     the maximum supported size, instead of overflowing the internal buffer.
diff --git a/ChangeLog.d/tls13-session-load-hardening.txt b/ChangeLog.d/tls13-session-load-hardening.txt
deleted file mode 100644
index d56e14cfac..0000000000
--- a/ChangeLog.d/tls13-session-load-hardening.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Bugfix
-   * Reject malformed TLS 1.3 serialized sessions instead of accepting
-     unterminated strings or extra trailing data.
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index ef368db8c2..cbb3959c6e 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5012,6 +5012,10 @@ static int ssl_context_load(mbedtls_ssl_context *ssl,
         return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
     }
 
+    if (ssl->transform->in_cid_len > sizeof(ssl->transform->in_cid)) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
     memcpy(ssl->transform->in_cid, p, ssl->transform->in_cid_len);
     p += ssl->transform->in_cid_len;
 
@@ -5021,6 +5025,10 @@ static int ssl_context_load(mbedtls_ssl_context *ssl,
         return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
     }
 
+    if (ssl->transform->out_cid_len > sizeof(ssl->transform->out_cid)) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
     memcpy(ssl->transform->out_cid, p, ssl->transform->out_cid_len);
     p += ssl->transform->out_cid_len;
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */