diff --git a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
index baa8c4d6..40199571 100644
--- a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
+++ b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
@@ -13,6 +13,9 @@
 public abstract class AbstractAutomatonBuilder<
         B extends AbstractAutomatonBuilder<B, A>, A extends Automaton> {
 
+    /** Maximum allowed states in an automaton to prevent memory exhaustion (DoS). */
+    private static final int MAX_STATES = 10000;
+
     protected final Map<String, State> states = new HashMap<>();
     protected final Set<State> finalStates = new HashSet<>();
     protected State initialState;
@@ -37,8 +40,13 @@ protected AbstractAutomatonBuilder() {
      * @param name The name of the state.
      * @param isFinal True if the state is an accepting state.
      * @return The current builder instance.
+     * @throws IllegalStateException if the maximum number of states is exceeded.
      */
     public B addState(String name, boolean isFinal) {
+        if (!states.containsKey(name) && states.size() >= MAX_STATES) {
+            throw new IllegalStateException(
+                    "Maximum number of states exceeded (Security: DoS prevention).");
+        }
         State state = new State(name, isFinal);
         states.put(name, state);
         if (isFinal) {