diff --git a/httpd/httpd.c b/httpd/httpd.c
index 03b2d74..d856ccd 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -664,7 +664,16 @@ void httpd_appcall(void)
 				parse_short(q + 15);
 				send_vlan(short_parsed);
 			} else if (is_word(q, "/counters.json")) {
-				send_counters(q[20]-'0');
+				/* The port is one raw character of the request line and
+				 * indexes a nine entry table, so bound it here instead
+				 * of trusting the client to have sent a digit. Anything
+				 * below '0' wraps well past eight, so the one test
+				 * covers both ends. */
+				uint8_t cport = q[20] - '0';
+				if (cport > 8)
+					send_bad_request();
+				else
+					send_counters(cport);
 			} else if (is_word(q, "/eee.json")) {
 				send_eee();
 			} else if (is_word(q, "/bandwidth.json")) {