diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69710c3f..3ee1094e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Changed
+
+- Ensure homepage string is not too long in cabal.rb to avoid DOS attack
+
 ## 4.5.0
 
 ### Changed
diff --git a/lib/licensed/sources/cabal.rb b/lib/licensed/sources/cabal.rb
index 73936194..fe4ab49c 100644
--- a/lib/licensed/sources/cabal.rb
+++ b/lib/licensed/sources/cabal.rb
@@ -71,6 +71,12 @@ def package_docs_dirs(package)
       # Returns a homepage url that enforces https and removes url fragments
       def safe_homepage(homepage)
         return unless homepage
+        # Ensure there's no denial of service issue with a long homepage
+        # 1000 characters is likely enough for any real project homepage
+        # See https://github.com/github/licensed/security/code-scanning/1
+        if homepage.length > 1000
+          raise ArgumentError, "Input too long"
+        end
         # use https and remove url fragment
         homepage.gsub(/http:/, "https:")
                 .gsub(/#[^?]*\z/, "")