diff --git a/lib/Controller/LocalController.php b/lib/Controller/LocalController.php
index 6ad03df4f..c2a67b82f 100644
--- a/lib/Controller/LocalController.php
+++ b/lib/Controller/LocalController.php
@@ -36,6 +36,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\Http\FileDisplayResponse;
 use OCP\AppFramework\OCS\OCSException;
@@ -70,6 +71,7 @@ public function __construct(
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 10, period: 60)]
 	public function create(string $name, bool $personal = false, bool $local = false): DataResponse {
 		try {
 			if (!$this->configService->isGSAvailable() && $local === true) {
diff --git a/lib/Exceptions/CircleNameTooLongException.php b/lib/Exceptions/CircleNameTooLongException.php
new file mode 100644
index 000000000..08dead79f
--- /dev/null
+++ b/lib/Exceptions/CircleNameTooLongException.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Exceptions;
+
+class CircleNameTooLongException extends FederatedItemBadRequestException {
+}
diff --git a/lib/FederatedItems/CircleEdit.php b/lib/FederatedItems/CircleEdit.php
index cec2be945..d6c43e143 100644
--- a/lib/FederatedItems/CircleEdit.php
+++ b/lib/FederatedItems/CircleEdit.php
@@ -11,6 +11,7 @@
 
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\RequestBuilderException;
 use OCA\Circles\IFederatedItem;
@@ -49,6 +50,7 @@ public function __construct(
 	 *
 	 * @throws RequestBuilderException
 	 * @throws CircleNameTooShortException
+	 * @throws CircleNameTooLongException
 	 */
 	public function verify(FederatedEvent $event): void {
 		$circle = $event->getCircle();
@@ -63,6 +65,8 @@ public function verify(FederatedEvent $event): void {
 			$new->setName($this->circleService->cleanCircleName($data->g('name')));
 			if (strlen($new->getName()) < 3) {
 				throw new CircleNameTooShortException('Circle name is too short');
+			} elseif (strlen($new->getName()) > 127) {
+				throw new CircleNameTooLongException('Circle name is too long');
 			}
 			$event->getData()->s('name', $new->getName());
 		}
diff --git a/lib/Service/CircleService.php b/lib/Service/CircleService.php
index 548245be8..78484b866 100644
--- a/lib/Service/CircleService.php
+++ b/lib/Service/CircleService.php
@@ -12,6 +12,7 @@
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\CircleNotFoundException;
 use OCA\Circles\Exceptions\FederatedEventException;
@@ -146,6 +147,8 @@ public function create(
 
 		if (strlen($circle->getName()) < 3) {
 			throw new CircleNameTooShortException('Circle name is too short');
+		} elseif (strlen($circle->getName()) > 127) {
+			throw new CircleNameTooLongException('Circle name is too long');
 		}
 
 		if ($personal) {