diff --git a/src/xml.c b/src/xml.c
index 881385a28..54acc4d8f 100644
--- a/src/xml.c
+++ b/src/xml.c
@@ -516,10 +516,20 @@ lyxml_parse_value(struct lyxml_ctx *xmlctx, char endchar, char **value, uint32_t
                 ADD_CHECK_OVERFLOW(offset, 1, error);
                 if (isdigit(in[offset])) {
                     for (n = 0; isdigit(in[offset]); offset++) {
+                        if (n > 0x10ffff) {
+                            /* too large, would overflow */
+                            LOGVAL(ctx, NULL, LYVE_SYNTAX, "Invalid character reference \"%.12s\".", p);
+                            goto error;
+                        }
                         n = (LY_BASE_DEC * n) + (in[offset] - '0');
                     }
                 } else if ((in[offset] == 'x') && isxdigit(in[offset + 1])) {
                     for (n = 0, ++offset; isxdigit(in[offset]); offset++) {
+                        if (n > 0x10ffff) {
+                            /* too large, would overflow */
+                            LOGVAL(ctx, NULL, LYVE_SYNTAX, "Invalid character reference \"%.12s\".", p);
+                            goto error;
+                        }
                         if (isdigit(in[offset])) {
                             u = (in[offset] - '0');
                         } else if (in[offset] > 'F') {
diff --git a/tests/utests/basic/test_xml.c b/tests/utests/basic/test_xml.c
index 5712f3468..c47adbf82 100644
--- a/tests/utests/basic/test_xml.c
+++ b/tests/utests/basic/test_xml.c
@@ -268,6 +268,22 @@ test_text(void **state)
     str = "<e xmlns=\"urn:test\" attr=\'&#xffff;\'";
     assert_int_equal(LY_EVALID, lyd_parse_data_mem(ctx, str, LYD_XML, 0, LYD_VALIDATE_PRESENT, &tree));
     CHECK_LOG_CTX("Invalid character reference \"&#xffff;\'\" (0x0000ffff).", NULL, 1);
+
+    /* character references too large to fit, must not wrap around to "<" */
+    str = "<e xmlns=\"urn:test\" attr=\'&#4294967356;\'";
+    assert_int_equal(LY_EVALID, lyd_parse_data_mem(ctx, str, LYD_XML, 0, LYD_VALIDATE_PRESENT, &tree));
+    CHECK_LOG_CTX("Invalid character reference \"&#4294967356\".", NULL, 1);
+
+    str = "<e xmlns=\"urn:test\">&#x10000003C;</e>";
+    assert_int_equal(LY_EVALID, lyd_parse_data_mem(ctx, str, LYD_XML, 0, LYD_VALIDATE_PRESENT, &tree));
+    CHECK_LOG_CTX("Invalid character reference \"&#x10000003C\".", NULL, 1);
+
+    /* leading zeros are fine */
+    str = "<e xmlns=\"urn:test\">&#00000000000000000060;&#x0000000000003C;</e>";
+    assert_int_equal(LY_SUCCESS, lyd_parse_data_mem(ctx, str, LYD_XML, 0, LYD_VALIDATE_PRESENT, &tree));
+    assert_non_null(tree);
+    lyd_free_all(tree);
+    tree = NULL;
 }
 
 static void