diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index c014e4a..703698d 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -314,7 +314,10 @@ public static function findSitePath(Request $request, $require_settings = TRUE)
     if (!$script_name) {
       $script_name = $request->server->get('SCRIPT_FILENAME');
     }
-    $http_host = $request->server->get('HTTP_HOST');
+    $http_host = $request->getHost();
+    if (DrupalKernel::validateHostnameLength($http_host) == FALSE) {
+      throw new \UnexpectedValueException('Bad hostname');
+    }
 
     $sites = array();
     include DRUPAL_ROOT . '/sites/sites.php';
@@ -810,7 +813,7 @@ protected function initializeRequestGlobals(Request $request) {
     else {
       // Create base URL.
       $http_protocol = $request->isSecure() ? 'https' : 'http';
-      $base_root = $http_protocol . '://' . $request->server->get('HTTP_HOST');
+      $base_root = $http_protocol . '://' . $request->getHost();
 
       $base_url = $base_root;
 
@@ -892,9 +895,7 @@ protected function initializeCookieGlobals(Request $request) {
       // Replace "core" out of session_name so core scripts redirect properly,
       // specifically install.php.
       $session_name = preg_replace('/\/core$/', '', $session_name);
-      // HTTP_HOST can be modified by a visitor, but has been sanitized already
-      // in DrupalKernel::bootEnvironment().
-      if ($cookie_domain = $request->server->get('HTTP_HOST')) {
+      if ($cookie_domain = $request->getHost()) {
         // Strip leading periods, www., and port numbers from cookie domain.
         $cookie_domain = ltrim($cookie_domain, '.');
         if (strpos($cookie_domain, 'www.') === 0) {
@@ -1249,4 +1250,23 @@ protected function classLoaderAddMultiplePsr4(array $namespaces = array()) {
     }
   }
 
+  /**
+   * Validates a hostname length.
+   *
+   * @param string $host
+   *   A hostname.
+   *
+   * @return bool|void
+   *   TRUE if the length is appropriate, or FALSE otherwise.
+   */
+  public static function validateHostnameLength($host) {
+    // Limit the length of the host name to 1000 bytes to prevent DoS attacks
+    // with long host names.
+    return strlen($host) <= 1000
+    // Limit the number of subdomains and port separators to prevent DoS attacks
+    // in conf_path().
+    && substr_count($host, '.') <= 100
+    && substr_count($host, ':') <= 100;
+  }
+
 }