diff --git a/net/net6.c b/net/net6.c
index 4cff98df15c..8453c1ca754 100644
--- a/net/net6.c
+++ b/net/net6.c
@@ -397,6 +397,9 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
                icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
                csum = icmp->icmp6_cksum;
                hlen = ntohs(ip6->payload_len);
+               /* Validate payload length doesn't exceed available data */
+               if (hlen > len - IP6_HDR_SIZE)
+                       hlen = len - IP6_HDR_SIZE;
                icmp->icmp6_cksum = 0;
                /* checksum */
                csum_p = csum_partial((u8 *)icmp, hlen, 0);
@@ -424,6 +427,9 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
                udp = (struct udp_hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
                csum = udp->udp_xsum;
                hlen = ntohs(ip6->payload_len);
+               /* Validate payload length doesn't exceed available data */
+               if (hlen > len - IP6_HDR_SIZE)
+                       hlen = len - IP6_HDR_SIZE;
                udp->udp_xsum = 0;
                /* checksum */
                csum_p = csum_partial((u8 *)udp, hlen, 0);