diff --git a/src/core/dhcp/nm-dhcp-nettools.c b/src/core/dhcp/nm-dhcp-nettools.c
index 90520dab3e..2c6d07775f 100644
--- a/src/core/dhcp/nm-dhcp-nettools.c
+++ b/src/core/dhcp/nm-dhcp-nettools.c
@@ -951,7 +951,12 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
                                    NM_DHCP_OPTION_DHCP4_PRIVATE_PROXY_AUTODISCOVERY,
                                    &l_data,
                                    &l_data_len);
-    if (r == 0) {
+    if (r == 0 && nm_dhcp_lease_data_parse_cstr(l_data, l_data_len, &l_data_len)) {
+        /* https://tools.ietf.org/html/draft-ietf-wrec-wpad-01#section-4.4.1
+         *
+         * We reject NUL characters inside the string (except one trailing NUL).
+         * Otherwise, we allow any encoding and backslash-escape the result to
+         * UTF-8. */
         nm_dhcp_option_add_option_utf8safe_escape(options,
                                                   _nm_dhcp_option_dhcp4_options,
                                                   NM_DHCP_OPTION_DHCP4_PRIVATE_PROXY_AUTODISCOVERY,