diff --git a/src/java.base/share/classes/sun/security/util/DerValue.java b/src/java.base/share/classes/sun/security/util/DerValue.java
index ec8b482b07d..8d86c8dd143 100644
--- a/src/java.base/share/classes/sun/security/util/DerValue.java
+++ b/src/java.base/share/classes/sun/security/util/DerValue.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -157,6 +157,9 @@ public class DerValue {
      */
     public static final byte    tag_SetOf = 0x31;
 
+    // Max nested depth for constructed data
+    private static final int MAX_CONSTRUCTED_NEST = 30;
+
     // This class is mostly immutable except that:
     //
     // 1. resetTag() modifies the tag
@@ -564,6 +567,14 @@ public class DerValue {
      * @return the octet string held in this DER value
      */
     public byte[] getOctetString() throws IOException {
+        return getOctetString(0);
+    }
+
+    private byte[] getOctetString(int limit) throws IOException {
+        if (++limit > MAX_CONSTRUCTED_NEST) {
+            throw new IOException("Nested OctetString limit reached ("
+                + MAX_CONSTRUCTED_NEST + ").");
+        }
 
         if (tag != tag_OctetString && !isConstructed(tag_OctetString)) {
             throw new IOException(
@@ -582,7 +593,7 @@ public class DerValue {
             ByteArrayOutputStream bout = new ByteArrayOutputStream();
             DerInputStream dis = data();
             while (dis.available() > 0) {
-                bout.write(dis.getDerValue().getOctetString());
+                bout.write(dis.getDerValue().getOctetString(limit));
             }
             return bout.toByteArray();
         }