diff --git a/src/libraries/Common/src/System/Net/Http/aspnetcore/Http3/QPack/QPackDecoder.cs b/src/libraries/Common/src/System/Net/Http/aspnetcore/Http3/QPack/QPackDecoder.cs
index 155bb5fc8ca6bc..f4b3691e932072 100644
--- a/src/libraries/Common/src/System/Net/Http/aspnetcore/Http3/QPack/QPackDecoder.cs
+++ b/src/libraries/Common/src/System/Net/Http/aspnetcore/Http3/QPack/QPackDecoder.cs
@@ -712,6 +712,8 @@ private static bool IsHuffmanEncoded(byte b)
 
         private void OnIndexedHeaderName(int index)
         {
+            ThrowIfInvalidStaticIndex(index);
+
             _headerStaticIndex = index;
             _state = State.HeaderValueLength;
         }
@@ -751,10 +753,20 @@ private void OnRequiredInsertCount(int requiredInsertCount)
 
         private void OnIndexedHeaderField(int index, IHttpStreamHeadersHandler handler)
         {
+            ThrowIfInvalidStaticIndex(index);
+
             handler.OnStaticIndexedHeader(index);
             _state = State.CompressedHeaders;
         }
 
+        private static void ThrowIfInvalidStaticIndex(int index)
+        {
+            if (index >= H3StaticTable.Count)
+            {
+                throw new QPackDecodingException(SR.Format(SR.net_http_qpack_invalid_index, index));
+            }
+        }
+
         private static void ThrowDynamicTableNotSupported()
         {
             throw new QPackDecodingException(SR.net_http_qpack_no_dynamic_table);
diff --git a/src/libraries/Common/src/System/Net/Http/aspnetcore/SR.resx b/src/libraries/Common/src/System/Net/Http/aspnetcore/SR.resx
index 9c5ece61a779f6..54ec7fab30c258 100644
--- a/src/libraries/Common/src/System/Net/Http/aspnetcore/SR.resx
+++ b/src/libraries/Common/src/System/Net/Http/aspnetcore/SR.resx
@@ -150,6 +150,9 @@
   <data name="net_http_invalid_header_name" xml:space="preserve">
     <value>Received an invalid header name: '{0}'.</value>
   </data>
+  <data name="net_http_qpack_invalid_index" xml:space="preserve">
+    <value>Invalid header index: {0} is outside of the static table.</value>
+  </data>
   <data name="net_http_qpack_no_dynamic_table" xml:space="preserve">
     <value>No dynamic table support</value>
   </data>
diff --git a/src/libraries/Common/tests/Tests/System/Net/aspnetcore/Http3/QPackDecoderTest.cs b/src/libraries/Common/tests/Tests/System/Net/aspnetcore/Http3/QPackDecoderTest.cs
index e78b93517aa0f8..6414acbc363594 100644
--- a/src/libraries/Common/tests/Tests/System/Net/aspnetcore/Http3/QPackDecoderTest.cs
+++ b/src/libraries/Common/tests/Tests/System/Net/aspnetcore/Http3/QPackDecoderTest.cs
@@ -340,6 +340,20 @@ public void DecodesIncompleteHeaderBlock_Error(byte[] encoded)
             Assert.Empty(_handler.DecodedHeaders);
         }
 
+        [Theory]
+        // Indexed Field Line - Static Table - Index 99 (out of range)
+        [InlineData(new byte[] { 0xff, 0x24 }, 99)]
+        // Literal Header Field With Name Reference - Static Table - Index 99 (out of range)
+        [InlineData(new byte[] { 0x5f, 0x54, 0x01, 0x61 }, 99)]
+        public void DecodesIndexOutsideStaticTable_Error(byte[] encoded, int index)
+        {
+            _decoder.Decode([0x00, 0x00], endHeaders: false, handler: _handler);
+
+            var exception = Assert.Throws<QPackDecodingException>(() => _decoder.Decode(encoded, endHeaders: true, handler: _handler));
+            Assert.Equal(SR.Format(SR.net_http_qpack_invalid_index, index), exception.Message);
+            Assert.Empty(_handler.DecodedHeaders);
+        }
+
         private static void TestDecodeWithoutIndexing(byte[] encoded, string expectedHeaderName, string expectedHeaderValue)
         {
             KeyValuePair<string, string>[] expectedValues = new[] { new KeyValuePair<string, string>(expectedHeaderName, expectedHeaderValue) };
diff --git a/src/libraries/System.Net.Http/src/Resources/Strings.resx b/src/libraries/System.Net.Http/src/Resources/Strings.resx
index bafb9a33c7da59..54cc86d539c77c 100644
--- a/src/libraries/System.Net.Http/src/Resources/Strings.resx
+++ b/src/libraries/System.Net.Http/src/Resources/Strings.resx
@@ -501,6 +501,9 @@
   <data name="net_http_content_write_larger_than_content_length" xml:space="preserve">
     <value>Unable to write content to request stream; content would exceed Content-Length.</value>
   </data>
+  <data name="net_http_qpack_invalid_index" xml:space="preserve">
+    <value>The HTTP/3 server attempted to reference the static table index {0}, which does not exist.</value>
+  </data>
   <data name="net_http_qpack_no_dynamic_table" xml:space="preserve">
     <value>The HTTP/3 server attempted to reference a dynamic table index that does not exist.</value>
   </data>