diff --git a/src/Asn1Decode.sol b/src/Asn1Decode.sol
index 6e4f27f..f2d1e6d 100644
--- a/src/Asn1Decode.sol
+++ b/src/Asn1Decode.sol
@@ -114,6 +114,7 @@ library Asn1Decode {
      */
     function bitstring(bytes memory der, Asn1Ptr ptr) internal pure returns (Asn1Ptr) {
         if (der[ptr.header()] != 0x03) revert InvalidAsn1Type();
+        if (ptr.length() == 0) revert InvalidAsn1Length();
         // Only 00 padded bitstr can be converted to bytestr!
         if (der[ptr.content()] != 0x00) revert InvalidAsn1Value();
         return LibAsn1Ptr.toAsn1Ptr(ptr.header(), ptr.content() + 1, ptr.length() - 1);
diff --git a/test/Asn1Decode.t.sol b/test/Asn1Decode.t.sol
index d5577db..1b78a8d 100644
--- a/test/Asn1Decode.t.sol
+++ b/test/Asn1Decode.t.sol
@@ -186,6 +186,11 @@ contract Asn1DecodeTest is Test {
         h.bitstringContent(hex"0401ff");
     }
 
+    function test_bitstring_empty_reverts() public {
+        vm.expectRevert(Asn1Decode.InvalidAsn1Length.selector);
+        h.bitstringContent(hex"0300");
+    }
+
     function test_bitstring_nonZeroPadded_reverts() public {
         vm.expectRevert(Asn1Decode.InvalidAsn1Value.selector);
         h.bitstringContent(hex"03020100"); // pad byte is 0x01, not 0x00