@@ -11,6 +11,7 @@ dev
 - `Stream.end_stream()` now raises `NoSuchStreamError` or `StreamClosedError` exceptions, instead of a generic `KeyError`.
 - Duplicate ``content-length`` headers with different values now raise ``ProtocolError``.
   Previously, the first ``content-length`` header was accepted and later conflicting values were ignored.
+- Parse ``content-length`` headers according to RFC9110 grammar for numbers (1*DIGIT)
 - **backfill from v4.3.0** Convert emitted events into Python `dataclass`, which introduces new constructors with required arguments.
   Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.
 
 
@@ -1368,6 +1368,11 @@ def _initialize_content_length(self, headers: Iterable[Header]) -> None:
 
         for n, v in headers:
             if n == b"content-length":
+                if not v.isdigit():
+                    # https://www.rfc-editor.org/rfc/rfc9110.html#name-content-length
+                    # RFC grammar for content-length is 1*DIGIT, so any non-digit value is invalid.
+                    msg = f"Invalid content-length header: {v!r}"
+                    raise ProtocolError(msg)
                 try:
                     parsed_content_length = int(v, 10)
                 except ValueError as err:
 
@@ -81,6 +81,40 @@ def test_duplicate_matching_content_lengths(self, frame_factory, request_headers
         assert isinstance(events[2], h2.events.StreamEnded)
         assert c.data_to_send() == b""
 
+    @pytest.mark.parametrize(
+        "value", [
+            "15a", "15.0", "-15", "+15", " 15", "15 ", "1e2", "0xF", "15_000", "15,000", "NaN", "\x00", "0b1111", "0o17",
+            ("1" * 5000), # https://docs.python.org/3/library/stdtypes.html#int-max-str-digits
+        ],
+    )
+    def test_content_length_with_non_digit_value(self, frame_factory, value) -> None:
+        """
+        Remote peers sending content-length with non-digit value causes Protocol
+        Errors.
+        """
+        c = h2.connection.H2Connection(config=self.server_config)
+        c.initiate_connection()
+        c.receive_data(frame_factory.preamble())
+        c.clear_outbound_data_buffer()
+
+        headers = frame_factory.build_headers_frame(
+            headers=[
+                *self.example_request_headers_bytes_without_content_length,
+                ("content-length", value),
+            ],
+        )
+        with pytest.raises(
+            h2.exceptions.ProtocolError,
+            match=f"Invalid content-length header",
+        ):
+            c.receive_data(headers.serialize())
+
+        expected_frame = frame_factory.build_goaway_frame(
+            last_stream_id=1,
+            error_code=h2.errors.ErrorCodes.PROTOCOL_ERROR,
+        )
+        assert c.data_to_send() == expected_frame.serialize()
+
     @pytest.mark.parametrize(
         "request_headers",
         [