diff --git a/cmd/prometheus/config.go b/cmd/prometheus/config.go
index e8302a03a..af124cc26 100644
--- a/cmd/prometheus/config.go
+++ b/cmd/prometheus/config.go
@@ -80,6 +80,14 @@ func init() {
 		&cfg.web.ListenAddress, "web.listen-address", ":9090",
 		"Address to listen on for the web interface, API, and telemetry.",
 	)
+	cfg.fs.DurationVar(
+		&cfg.web.ReadTimeout, "web.read-timeout", 30*time.Second,
+		"Maximum duration before timing out read of the request, and closing idle connections.",
+	)
+	cfg.fs.IntVar(
+		&cfg.web.MaxConnections, "web.max-connections", 512,
+		"Maximum number of simultaneous connections.",
+	)
 	cfg.fs.StringVar(
 		&cfg.prometheusURL, "web.external-url", "",
 		"The URL under which Prometheus is externally reachable (for example, if Prometheus is served via a reverse proxy). Used for generating relative and absolute links back to Prometheus itself. If the URL has a path portion, it will be used to prefix all HTTP endpoints served by Prometheus. If omitted, relevant URL components will be derived automatically.",
diff --git a/vendor/golang.org/x/net/netutil/listen.go b/vendor/golang.org/x/net/netutil/listen.go
new file mode 100644
index 000000000..b317ba2e6
--- /dev/null
+++ b/vendor/golang.org/x/net/netutil/listen.go
@@ -0,0 +1,48 @@
+// Copyright 2013 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package netutil provides network utility functions, complementing the more
+// common ones in the net package.
+package netutil // import "golang.org/x/net/netutil"
+
+import (
+	"net"
+	"sync"
+)
+
+// LimitListener returns a Listener that accepts at most n simultaneous
+// connections from the provided Listener.
+func LimitListener(l net.Listener, n int) net.Listener {
+	return &limitListener{l, make(chan struct{}, n)}
+}
+
+type limitListener struct {
+	net.Listener
+	sem chan struct{}
+}
+
+func (l *limitListener) acquire() { l.sem <- struct{}{} }
+func (l *limitListener) release() { <-l.sem }
+
+func (l *limitListener) Accept() (net.Conn, error) {
+	l.acquire()
+	c, err := l.Listener.Accept()
+	if err != nil {
+		l.release()
+		return nil, err
+	}
+	return &limitListenerConn{Conn: c, release: l.release}, nil
+}
+
+type limitListenerConn struct {
+	net.Conn
+	releaseOnce sync.Once
+	release     func()
+}
+
+func (l *limitListenerConn) Close() error {
+	err := l.Conn.Close()
+	l.releaseOnce.Do(l.release)
+	return err
+}
diff --git a/vendor/vendor.json b/vendor/vendor.json
index 4afb1fcb7..aae150ab6 100644
--- a/vendor/vendor.json
+++ b/vendor/vendor.json
@@ -695,6 +695,12 @@
 			"revision": "c589d0c9f0d81640c518354c7bcae77d99820aa3",
 			"revisionTime": "2016-09-30T00:14:02Z"
 		},
+		{
+			"checksumSHA1": "7WASrg0PEueWDDRHkFhEEN6Qrms=",
+			"path": "golang.org/x/net/netutil",
+			"revision": "bc3663df0ac92f928d419e31e0d2af22e683a5a2",
+			"revisionTime": "2016-06-21T20:48:10Z"
+		},
 		{
 			"checksumSHA1": "mktBVED98G2vv+OKcSgtnFVZC1Y=",
 			"path": "golang.org/x/oauth2",
diff --git a/web/web.go b/web/web.go
index 8f24e554c..97dd0b0a4 100644
--- a/web/web.go
+++ b/web/web.go
@@ -37,6 +37,7 @@ import (
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/common/route"
 	"golang.org/x/net/context"
+	"golang.org/x/net/netutil"
 
 	"github.com/prometheus/prometheus/config"
 	"github.com/prometheus/prometheus/notifier"
@@ -112,6 +113,8 @@ type Options struct {
 	Flags         map[string]string
 
 	ListenAddress        string
+	ReadTimeout          time.Duration
+	MaxConnections       int
 	ExternalURL          *url.URL
 	RoutePrefix          string
 	MetricsPath          string
@@ -255,11 +258,18 @@ func (h *Handler) Reload() <-chan chan error {
 func (h *Handler) Run() {
 	log.Infof("Listening on %s", h.options.ListenAddress)
 	server := &http.Server{
-		Addr:     h.options.ListenAddress,
-		Handler:  h.router,
-		ErrorLog: log.NewErrorLogger(),
+		Addr:        h.options.ListenAddress,
+		Handler:     h.router,
+		ErrorLog:    log.NewErrorLogger(),
+		ReadTimeout: h.options.ReadTimeout,
+	}
+	listener, err := net.Listen("tcp", h.options.ListenAddress)
+	if err != nil {
+		h.listenErrCh <- err
+	} else {
+		limitedListener := netutil.LimitListener(listener, h.options.MaxConnections)
+		h.listenErrCh <- server.Serve(limitedListener)
 	}
-	h.listenErrCh <- server.ListenAndServe()
 }
 
 func (h *Handler) alerts(w http.ResponseWriter, r *http.Request) {