diff --git a/src/hotspot/share/jfr/periodic/jfrRedactedEvents.cpp b/src/hotspot/share/jfr/periodic/jfrRedactedEvents.cpp
index 5ace0d0fae4..331c28cffa2 100644
--- a/src/hotspot/share/jfr/periodic/jfrRedactedEvents.cpp
+++ b/src/hotspot/share/jfr/periodic/jfrRedactedEvents.cpp
@@ -609,6 +609,9 @@ bool JfrRedactedEvents::match_key(StringArray* filters, const char* text) {
 }
 
 bool JfrRedactedEvents::read_file(StringArray* target, const char* filename) {
+  if (!is_valid_redaction_file(filename)) {
+    return false;
+  }
   FILE* file = os::fopen(filename, "r");
   if (file == nullptr) {
     log_error(jfr, redact)("Failed to open redaction file: %s", filename);
@@ -661,3 +664,21 @@ StringArray* JfrRedactedEvents::split(const char* text, char separator) {
   }
   return result;
 }
+
+bool JfrRedactedEvents::is_valid_redaction_file(const char* filename) {
+  struct stat st;
+  int ret = os::stat(filename, &st);
+  if (ret != 0) {
+    log_error(jfr, redact)("Failed to access redaction file %s", filename);
+    return false;
+  }
+  if ((st.st_mode & S_IFMT) != S_IFREG) {
+    log_error(jfr, redact)("Redaction file %s is not a regular file", filename);
+    return false;
+  }
+  if (st.st_size > 1024*1024) {
+    log_error(jfr, redact)("Redaction file %s is too large (1024 KB).", filename);
+    return false;
+  }
+  return true;
+}
diff --git a/src/hotspot/share/jfr/periodic/jfrRedactedEvents.hpp b/src/hotspot/share/jfr/periodic/jfrRedactedEvents.hpp
index 38c93310365..dc972190b6c 100644
--- a/src/hotspot/share/jfr/periodic/jfrRedactedEvents.hpp
+++ b/src/hotspot/share/jfr/periodic/jfrRedactedEvents.hpp
@@ -205,6 +205,7 @@ class JfrRedactedEvents: public AllStatic {
   static bool equals_case_insensitive(char a, char b);
   static bool is_redacted_key(const char* key);
   static bool is_separator(char c);
+  static bool is_valid_redaction_file(const char* filename);
   static bool is_whitespace(char c);
   static void ensure_initialized();
   static StringArray* make_java_args_array();