diff --git a/internal/api/docker_metadata.go b/internal/api/docker_metadata.go
index 579a819f9..7ebe5907f 100644
--- a/internal/api/docker_metadata.go
+++ b/internal/api/docker_metadata.go
@@ -78,6 +78,9 @@ func (h *DockerMetadataHandler) HandleUpdateMetadata(w http.ResponseWriter, r *h
 		return
 	}
 
+	// Limit request body to 16KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+
 	var meta config.DockerMetadata
 	if err := json.NewDecoder(r.Body).Decode(&meta); err != nil {
 		http.Error(w, "Invalid request body", http.StatusBadRequest)
diff --git a/internal/api/guest_metadata.go b/internal/api/guest_metadata.go
index 863142467..3a567225c 100644
--- a/internal/api/guest_metadata.go
+++ b/internal/api/guest_metadata.go
@@ -83,6 +83,9 @@ func (h *GuestMetadataHandler) HandleUpdateMetadata(w http.ResponseWriter, r *ht
 		return
 	}
 
+	// Limit request body to 16KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+
 	var meta config.GuestMetadata
 	if err := json.NewDecoder(r.Body).Decode(&meta); err != nil {
 		http.Error(w, "Invalid request body", http.StatusBadRequest)
diff --git a/internal/api/host_agents.go b/internal/api/host_agents.go
index 7931ded13..2fdad40f8 100644
--- a/internal/api/host_agents.go
+++ b/internal/api/host_agents.go
@@ -37,6 +37,8 @@ func (h *HostAgentHandlers) HandleReport(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	// Limit request body to 256KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 256*1024)
 	defer r.Body.Close()
 
 	var report agentshost.Report
diff --git a/internal/api/notification_queue.go b/internal/api/notification_queue.go
index 99184d9b0..2d04ffa99 100644
--- a/internal/api/notification_queue.go
+++ b/internal/api/notification_queue.go
@@ -85,6 +85,9 @@ func (h *NotificationQueueHandlers) RetryDLQItem(w http.ResponseWriter, r *http.
 		return
 	}
 
+	// Limit request body to 8KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 8*1024)
+
 	var request struct {
 		ID string `json:"id"`
 	}
@@ -129,6 +132,9 @@ func (h *NotificationQueueHandlers) DeleteDLQItem(w http.ResponseWriter, r *http
 		return
 	}
 
+	// Limit request body to 8KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 8*1024)
+
 	var request struct {
 		ID string `json:"id"`
 	}
diff --git a/internal/api/system_settings.go b/internal/api/system_settings.go
index ab5644384..2e5e288f6 100644
--- a/internal/api/system_settings.go
+++ b/internal/api/system_settings.go
@@ -462,6 +462,9 @@ func (h *SystemSettingsHandler) HandleUpdateSystemSettings(w http.ResponseWriter
 		existingSettings = config.DefaultSystemSettings()
 	}
 
+	// Limit request body to 64KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024)
+
 	// Read the request body into a map to check which fields were provided
 	var rawRequest map[string]interface{}
 	if err := json.NewDecoder(r.Body).Decode(&rawRequest); err != nil {
diff --git a/internal/api/temperature_proxy.go b/internal/api/temperature_proxy.go
index c5021ba52..135b686ce 100644
--- a/internal/api/temperature_proxy.go
+++ b/internal/api/temperature_proxy.go
@@ -176,6 +176,8 @@ func (h *TemperatureProxyHandlers) HandleRegister(w http.ResponseWriter, r *http
 		return
 	}
 
+	// Limit request body to 8KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 8*1024)
 	defer r.Body.Close()
 
 	var req struct {
diff --git a/internal/api/updates.go b/internal/api/updates.go
index 4d121588b..8f382d7be 100644
--- a/internal/api/updates.go
+++ b/internal/api/updates.go
@@ -83,6 +83,9 @@ func (h *UpdateHandlers) HandleApplyUpdate(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	// Limit request body to 8KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 8*1024)
+
 	var req struct {
 		DownloadURL string `json:"downloadUrl"`
 	}