diff --git a/src/proto/h2/server.rs b/src/proto/h2/server.rs
index b9037ee3dd..88f4f88409 100644
--- a/src/proto/h2/server.rs
+++ b/src/proto/h2/server.rs
@@ -35,6 +35,8 @@ const DEFAULT_CONN_WINDOW: u32 = 1024 * 1024; // 1mb
 const DEFAULT_STREAM_WINDOW: u32 = 1024 * 1024; // 1mb
 const DEFAULT_MAX_FRAME_SIZE: u32 = 1024 * 16; // 16kb
 const DEFAULT_MAX_SEND_BUF_SIZE: usize = 1024 * 400; // 400kb
+// 16 MB "sane default" taken from golang http2
+const DEFAULT_SETTINGS_MAX_HEADER_LIST_SIZE: u32 = 16 << 20;
 
 #[derive(Clone, Debug)]
 pub(crate) struct Config {
@@ -49,6 +51,7 @@ pub(crate) struct Config {
     #[cfg(feature = "runtime")]
     pub(crate) keep_alive_timeout: Duration,
     pub(crate) max_send_buffer_size: usize,
+    pub(crate) max_header_list_size: u32,
 }
 
 impl Default for Config {
@@ -65,6 +68,7 @@ impl Default for Config {
             #[cfg(feature = "runtime")]
             keep_alive_timeout: Duration::from_secs(20),
             max_send_buffer_size: DEFAULT_MAX_SEND_BUF_SIZE,
+            max_header_list_size: DEFAULT_SETTINGS_MAX_HEADER_LIST_SIZE,
         }
     }
 }
@@ -116,6 +120,7 @@ where
             .initial_window_size(config.initial_stream_window_size)
             .initial_connection_window_size(config.initial_conn_window_size)
             .max_frame_size(config.max_frame_size)
+            .max_header_list_size(config.max_header_list_size)
             .max_send_buffer_size(config.max_send_buffer_size);
         if let Some(max) = config.max_concurrent_streams {
             builder.max_concurrent_streams(max);
diff --git a/src/server/conn.rs b/src/server/conn.rs
index 3f9eaf9e62..d5370b0f14 100644
--- a/src/server/conn.rs
+++ b/src/server/conn.rs
@@ -519,6 +519,16 @@ impl<E> Http<E> {
         self
     }
 
+    /// Sets the max size of received header frames.
+    ///
+    /// Default is currently ~16MB, but may change.
+    #[cfg(feature = "http2")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "http2")))]
+    pub fn http2_max_header_list_size(&mut self, max: u32) -> &mut Self {
+        self.h2_builder.max_header_list_size = max;
+        self
+    }
+
     /// Set the maximum buffer size for the connection.
     ///
     /// Default is ~400kb.