diff --git a/libekmfweb/cca.c b/libekmfweb/cca.c
index 411057c7..95e5f133 100644
--- a/libekmfweb/cca.c
+++ b/libekmfweb/cca.c
@@ -1061,6 +1061,12 @@ int cca_import_key_from_json_web_key(const struct ekmf_cca_lib *cca_lib,
 			pr_verbose(verbose, "Failed to get and decode x");
 			goto out;
 		}
+		if (len != prime_len) {
+			/* RFC 7517: Must be full size of a coordinate */
+			pr_verbose(verbose, "x coordinate length is wrong");
+			rc = -EINVAL;
+			goto out;
+		}
 
 		len = prime_len;
 		rc = json_object_get_base64url(jwk, "y", &q[1 + prime_len],
@@ -1069,6 +1075,12 @@ int cca_import_key_from_json_web_key(const struct ekmf_cca_lib *cca_lib,
 			pr_verbose(verbose, "Failed to get and decode y");
 			goto out;
 		}
+		if (len != prime_len) {
+			/* RFC 7517: Must be full size of a coordinate */
+			pr_verbose(verbose, "y coordinate length is wrong");
+			rc = -EINVAL;
+			goto out;
+		}
 
 		rule_array_count = 1;
 		memcpy(rule_array, "ECC-PUBL", CCA_KEYWORD_SIZE);
diff --git a/libekmfweb/utilities.c b/libekmfweb/utilities.c
index c2a40e81..3eaeb293 100644
--- a/libekmfweb/utilities.c
+++ b/libekmfweb/utilities.c
@@ -2254,11 +2254,21 @@ int json_web_key_as_pkey(json_object *jwk, int pkey_type, EVP_PKEY **pkey)
 		rc = json_object_get_base64url(jwk, "x", x, &len);
 		if (rc != 0)
 			goto out;
+		if (len != prime_len) {
+			/* RFC 7517: Must be full size of a coordinate */
+			rc = -EINVAL;
+			goto out;
+		}
 
 		len = prime_len;
 		rc = json_object_get_base64url(jwk, "y", y, &len);
 		if (rc != 0)
 			goto out;
+		if (len != prime_len) {
+			/* RFC 7517: Must be full size of a coordinate */
+			rc = -EINVAL;
+			goto out;
+		}
 
 		rc = ecc_pub_key_as_pkey(nid, prime_len, x, y, pkey);
 		if (rc != 0)