diff --git a/Lib/poplib.py b/Lib/poplib.py
--- a/Lib/poplib.py
+++ b/Lib/poplib.py
@@ -27,16 +27,22 @@ POP3_PORT = 110
 # POP SSL PORT
 POP3_SSL_PORT = 995
 
 # Line terminators (we always output CRLF, but accept any of CRLF, LFCR, LF)
 CR = '\r'
 LF = '\n'
 CRLF = CR+LF
 
+# maximal line length when calling readline(). This is to prevent
+# reading arbitrary length lines. RFC 1939 limits POP3 line length to
+# 512 characters, including CRLF. We have selected 2048 just to be on
+# the safe side.
+_MAXLINE = 2048
+
 
 class POP3:
 
     """This class supports both the minimal and optional command sets.
     Arguments can be strings or integers (where appropriate)
     (e.g.: retr(1) and retr('1') both work equally well.
 
     Minimal Command Set:
@@ -98,17 +104,19 @@ class POP3:
         self._putline(line)
 
 
     # Internal: return one line from the server, stripping CRLF.
     # This is where all the CPU time of this module is consumed.
     # Raise error_proto('-ERR EOF') if the connection is closed.
 
     def _getline(self):
-        line = self.file.readline()
+        line = self.file.readline(_MAXLINE + 1)
+        if len(line) > _MAXLINE:
+            raise error_proto('line too long')
         if self._debugging > 1: print '*get*', repr(line)
         if not line: raise error_proto('-ERR EOF')
         octets = len(line)
         # server can send any combination of CR & LF
         # however, 'readline()' returns lines ending in LF
         # so only possibilities are ...LF, ...CRLF, CR...LF
         if line[-2:] == CRLF:
             return line[:-2], octets
@@ -360,16 +368,18 @@ else:
             self.buffer += localbuf
 
         def _getline(self):
             line = ""
             renewline = re.compile(r'.*?\n')
             match = renewline.match(self.buffer)
             while not match:
                 self._fillBuffer()
+                if len(self.buffer) > _MAXLINE:
+                    raise error_proto('line too long')
                 match = renewline.match(self.buffer)
             line = match.group(0)
             self.buffer = renewline.sub('' ,self.buffer, 1)
             if self._debugging > 1: print '*get*', repr(line)
 
             octets = len(line)
             if line[-2:] == CRLF:
                 return line[:-2], octets
diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
--- a/Lib/test/test_poplib.py
+++ b/Lib/test/test_poplib.py
@@ -193,16 +193,20 @@ class TestPOP3Class(TestCase):
     def test_retr(self):
         expected = ('+OK 116 bytes',
                     ['From: postmaster@python.org', 'Content-Type: text/plain',
                      'MIME-Version: 1.0', 'Subject: Dummy',
                      '', 'line1', 'line2', 'line3'],
                     113)
         self.assertEqual(self.client.retr('foo'), expected)
 
+    def test_too_long_lines(self):
+        self.assertRaises(poplib.error_proto, self.client._shortcmd,
+                          'echo +%s' % ((poplib._MAXLINE + 10) * 'a'))
+
     def test_dele(self):
         self.assertOK(self.client.dele('foo'))
 
     def test_noop(self):
         self.assertOK(self.client.noop())
 
     def test_rpop(self):
         self.assertOK(self.client.rpop('foo'))