diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 933dfd5e66..65f6f9645d 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -185,6 +185,7 @@ static void AlertJsonReference(const PacketAlert *pa, SCJsonBuilder *jb)
          * add +2 to safisfy gcc 15 + -Wformat-truncation=2
          */
         const size_t size_needed = kv->key_len + kv->reference_len + 3;
+        DEBUG_VALIDATE_BUG_ON(size_needed > DETECT_MAX_RULE_SIZE);
         char kv_store[size_needed];
         snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
         SCJbAppendString(jb, kv_store);