diff --git a/ChangeLog.d/fix-x509-crl-entry-length-mismatch.txt b/ChangeLog.d/fix-x509-crl-entry-length-mismatch.txt
new file mode 100644
index 0000000000..733ba4ada7
--- /dev/null
+++ b/ChangeLog.d/fix-x509-crl-entry-length-mismatch.txt
@@ -0,0 +1,9 @@
+Bugfix
+   * Fix x509_get_entries() (used by mbedtls_x509_crl_parse()) not
+     checking that a revoked-certificate entry's serial number,
+     revocation date and optional crlEntryExtensions fully consume
+     the entry's own declared SEQUENCE length. A CRL entry with a
+     declared length longer than the sum of its actual fields could
+     have the extra trailing bytes silently reinterpreted as one or
+     more additional, attacker-influenced CRL entries, instead of
+     being rejected as malformed.
diff --git a/library/x509_crl.c b/library/x509_crl.c
index 0b98ba4664..8cb0d51cf3 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -262,6 +262,11 @@ static int x509_get_entries(unsigned char **p,
             return ret;
         }
 
+        if (*p != end2) {
+            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
+                                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
+        }
+
         if (*p < end) {
             cur_entry->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl_entry));