diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 792dc42..7dc62af 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -2503,6 +2503,7 @@ struct wpa_config * wpa_config_alloc_empty(const char *ctrl_interface,
 	config->max_num_sta = DEFAULT_MAX_NUM_STA;
 	config->access_network_type = DEFAULT_ACCESS_NETWORK_TYPE;
 	config->min_scan_gap = DEFAULT_MIN_SCAN_GAP;
+	config->max_assoc_per_scan = DEFAULT_MAX_ASSOC_PER_SCAN;
 
 	if (ctrl_interface)
 		config->ctrl_interface = os_strdup(ctrl_interface);
@@ -2875,6 +2876,7 @@ static const struct global_parse_data global_fields[] = {
 	{ INT(dot11RSNAConfigPMKReauthThreshold), 0 },
 	{ INT(dot11RSNAConfigSATimeout), 0 },
 	{ INT(min_scan_gap), 0 },
+	{ INT(max_assoc_per_scan), 0 },
 #ifndef CONFIG_NO_CONFIG_WRITE
 	{ INT(update_config), 0 },
 #endif /* CONFIG_NO_CONFIG_WRITE */
diff --git a/wpa_supplicant/config.h b/wpa_supplicant/config.h
index 1384add..e29b36b 100644
--- a/wpa_supplicant/config.h
+++ b/wpa_supplicant/config.h
@@ -24,6 +24,7 @@
 #define DEFAULT_MAX_NUM_STA 128
 #define DEFAULT_ACCESS_NETWORK_TYPE 15
 #define DEFAULT_MIN_SCAN_GAP 0
+#define DEFAULT_MAX_ASSOC_PER_SCAN 25
 
 #include "config_ssid.h"
 #include "wps/wps.h"
@@ -593,6 +594,12 @@ struct wpa_config {
 	/* Minimum interval between scan requests, in seconds */
 	int min_scan_gap;
 
+	/* Maximum number of association requests per scan results
+	 * This can be used to stop a thundering herd of hundreds of
+	 * virtual stations from all trying to associate at once.
+	 */
+	int max_assoc_per_scan;
+
 	/**
 	 * interworking - Whether Interworking (IEEE 802.11u) is enabled
 	 */
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index c666ea2..51f8d3c 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -42,6 +42,8 @@
 #include "offchannel.h"
 
 
+static int num_assoc_reqs;
+
 static int wpa_supplicant_select_config(struct wpa_supplicant *wpa_s)
 {
 	struct wpa_ssid *ssid, *old_ssid;
@@ -857,6 +859,15 @@ int wpa_supplicant_connect(struct wpa_supplicant *wpa_s,
 			wpa_supplicant_req_new_scan(wpa_s, 10, 0);
 			return 0;
 		}
+
+		if (num_assoc_reqs >= wpa_s->conf->max_assoc_per_scan) {
+			wpa_dbg(wpa_s, MSG_DEBUG,
+				"Deferring association attempt, reqs: %i, max: %i",
+				num_assoc_reqs, wpa_s->conf->max_assoc_per_scan);
+			return 0;
+		}
+		num_assoc_reqs++;
+
 		wpa_msg(wpa_s, MSG_DEBUG, "Request association: "
 			"reassociate: %d  selected: "MACSTR "  bssid: " MACSTR
 			"  pending: " MACSTR "  wpa_state: %s",
@@ -1150,6 +1161,14 @@ static int _wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s,
 		wpa_dbg(wpa_s, MSG_DEBUG, "No suitable network found");
 		ssid = wpa_supplicant_pick_new_network(wpa_s);
 		if (ssid) {
+			if (num_assoc_reqs >= wpa_s->conf->max_assoc_per_scan) {
+				wpa_dbg(wpa_s, MSG_DEBUG,
+					"Deferring association, reqs: %i, max: %i",
+					num_assoc_reqs, wpa_s->conf->max_assoc_per_scan);
+				return 0;
+			}
+			num_assoc_reqs++;
+
 			wpa_dbg(wpa_s, MSG_DEBUG, "Setup a new network");
 			wpa_supplicant_associate(wpa_s, NULL, ssid);
 			wpa_supplicant_rsn_preauth_scan_results(wpa_s);
@@ -1187,6 +1206,8 @@ static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s,
 	const char *rn, *rn2;
 	struct wpa_supplicant *ifs;
 
+	num_assoc_reqs = 0;
+
 	if (_wpa_supplicant_event_scan_results(wpa_s, data) < 0) {
 		/*
 		 * If no scan results could be fetched, then no need to