diff --git a/l2tpns.c b/l2tpns.c
index 6b8944c..e3b30fa 100644
--- a/l2tpns.c
+++ b/l2tpns.c
@@ -2701,7 +2701,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr, uint16_t indexu
 				uint8_t flags = *p;
 				uint16_t mtype;
 
-				if (n > l)
+				if ((n > l) || (n < 6))
 				{
 					LOG(1, s, t, "Invalid length in AVP\n");
 					STAT(tunnel_rx_errors);