diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs b/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
index 38b097ebd961b..174995454aec1 100644
--- a/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
@@ -686,8 +686,16 @@ private async ValueTask<int> EnsureFullTlsFrameAsync<TIOAdapter>(CancellationTok
 
             if (frameSize < int.MaxValue)
             {
+                // make sure we have space for the whole frame
                 _buffer.EnsureAvailableSpace(frameSize - _buffer.EncryptedLength);
             }
+            else
+            {
+                // move existing data to the beginning of the buffer (they will
+                // be couple of bytes only, otherwise we would have entire
+                // header and know exact size)
+                _buffer.EnsureAvailableSpace(_buffer.Capacity - _buffer.EncryptedLength);
+            }
 
             while (_buffer.EncryptedLength < frameSize)
             {