diff --git a/NEWS b/NEWS
index 12d75a1a..2d859dcb 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,6 @@
 * Version 1.5.0 (unreleased)
+- [SECURITY] Fixed unauthenticated heap buffer overflow in the unprivileged
+  worker process via an oversized webvpncontext= cookie value (#719)
 - Added `syslog-facility` option to log to specified syslog facility (#691)
 - Fixed worker hang when a client disappears silently (#638)
 - Removed the 'cgroup' configuration option (used for cgroups v1).
diff --git a/src/worker-http.c b/src/worker-http.c
index e8c9280d..063f3820 100644
--- a/src/worker-http.c
+++ b/src/worker-http.c
@@ -719,14 +719,23 @@ ciphersuite12_finish:
 				}
 
 				nlen = BASE64_DECODE_LENGTH(tmplen);
+				if (nlen < sizeof(ws->sid) ||
+				    nlen > sizeof(ws->sid) + 8)
+					return;
+
+				if (sizeof(ws->buffer) < sizeof(ws->sid) + 8)
+					abort();
+
 				ret = oc_base64_decode((uint8_t *)p, tmplen,
-						       ws->sid, &nlen);
+						       ws->buffer, &nlen);
 				if (ret == 0 || nlen != sizeof(ws->sid)) {
 					oclog(ws, LOG_SENSITIVE,
 					      "could not decode sid: %.*s",
 					      tmplen, p);
 					ws->sid_set = 0;
 				} else {
+					memcpy(ws->sid, ws->buffer,
+					       sizeof(ws->sid));
 					ws->sid_set = 1;
 					oclog(ws, LOG_SENSITIVE,
 					      "received sid: %.*s", tmplen, p);