diff --git a/components/bt/esp_ble_mesh/Kconfig.in b/components/bt/esp_ble_mesh/Kconfig.in
index 836b880f90b..3a04ae60ebf 100644
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@@ -1875,6 +1875,15 @@ if BLE_MESH
                 help
                     Enable the Device Distribution Client model
 
+            if BLE_MESH_DFD_CLI
+                config BLE_MESH_DFD_CLI_SRV_TARGETS_MAX
+                    int "Number of DFD SRVs can be accepted"
+                    default 3
+                    range 1 100
+                    help
+                        The maximum number of DFD SRVs that can be accepted.
+            endif
+
             config BLE_MESH_DFD_SRV
                 bool "Support for Firmware Distribution Server model"
                 depends on BLE_MESH_BLOB_SRV
diff --git a/components/bt/esp_ble_mesh/v1.1/dfu/dfd_cli.c b/components/bt/esp_ble_mesh/v1.1/dfu/dfd_cli.c
index 19fce3b9a8c..baa274276f0 100644
--- a/components/bt/esp_ble_mesh/v1.1/dfu/dfd_cli.c
+++ b/components/bt/esp_ble_mesh/v1.1/dfu/dfd_cli.c
@@ -142,8 +142,20 @@ static void handle_receiver_list(struct bt_mesh_model *model,
 
     dfd_status_t status = {0};
     status.receiver_list.entries_cnt = net_buf_simple_pull_le16(buf);
+
+    if (status.receiver_list.entries_cnt > CONFIG_BLE_MESH_DFD_CLI_SRV_TARGETS_MAX) {
+        BT_ERR("InvalidDfdSrvEntries:%d",status.receiver_list.entries_cnt);
+        return;
+    }
+
     status.receiver_list.first_index = net_buf_simple_pull_le16(buf);
     status.receiver_list.entries = bt_mesh_calloc(status.receiver_list.entries_cnt * sizeof(target_node_entry_t));
+
+    if (status.receiver_list.entries == NULL) {
+        BT_ERR("MemAllocFailedForSz:%d",status.receiver_list.entries_cnt * sizeof(target_node_entry_t));
+        return;
+    }
+
     for (i = 0; i < status.receiver_list.entries_cnt; i++) {
         target_info = net_buf_simple_pull_le32(buf);
         status.receiver_list.entries[i].addr = TARGET_ADDR(target_info);