diff --git a/quic/core/quic_crypto_stream.cc b/quic/core/quic_crypto_stream.cc
index 9d70139..e5b13f1 100644
--- a/quic/core/quic_crypto_stream.cc
+++ b/quic/core/quic_crypto_stream.cc
@@ -78,6 +78,11 @@
       << "Versions less than 47 shouldn't receive CRYPTO frames";
   EncryptionLevel level = session()->connection()->last_decrypted_level();
   substreams_[level].sequencer.OnCryptoFrame(frame);
+  if (substreams_[level].sequencer.NumBytesBuffered() >
+      BufferSizeLimitForLevel(frame.level)) {
+    CloseConnectionWithDetails(QUIC_FLOW_CONTROL_RECEIVED_TOO_MUCH_DATA,
+                               "Too much crypto data received");
+  }
 }
 
 void QuicCryptoStream::OnStreamFrame(const QuicStreamFrame& frame) {
@@ -181,6 +186,10 @@
   send_buffer->OnStreamDataConsumed(bytes_consumed);
 }
 
+size_t QuicCryptoStream::BufferSizeLimitForLevel(EncryptionLevel) const {
+  return GetQuicFlag(FLAGS_quic_max_buffered_crypto_bytes);
+}
+
 void QuicCryptoStream::OnSuccessfulVersionNegotiation(
     const ParsedQuicVersion& /*version*/) {}