diff --git a/crypto_stream.go b/crypto_stream.go
index 7f43a2a28..e1b284faa 100644
--- a/crypto_stream.go
+++ b/crypto_stream.go
@@ -6,6 +6,7 @@ import (
 	"io"
 
 	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/internal/utils"
 	"github.com/lucas-clemente/quic-go/internal/wire"
 )
@@ -68,7 +69,7 @@ func newCryptoStream() cryptoStream {
 func (s *cryptoStreamImpl) HandleCryptoFrame(f *wire.CryptoFrame) error {
 	highestOffset := f.Offset + protocol.ByteCount(len(f.Data))
 	if maxOffset := highestOffset; maxOffset > protocol.MaxCryptoStreamOffset {
-		return fmt.Errorf("received invalid offset %d on crypto stream, maximum allowed %d", maxOffset, protocol.MaxCryptoStreamOffset)
+		return qerr.Error(qerr.CryptoBufferExceeded, fmt.Sprintf("received invalid offset %d on crypto stream, maximum allowed %d", maxOffset, protocol.MaxCryptoStreamOffset))
 	}
 	if s.finished {
 		if highestOffset > s.highestOffset {
diff --git a/crypto_stream_test.go b/crypto_stream_test.go
index 834bbd5fd..ba9a464a3 100644
--- a/crypto_stream_test.go
+++ b/crypto_stream_test.go
@@ -55,7 +55,7 @@ var _ = Describe("Crypto Stream", func() {
 				Offset: protocol.MaxCryptoStreamOffset - 5,
 				Data:   []byte("foobar"),
 			})
-			Expect(err).To(MatchError(fmt.Sprintf("received invalid offset %d on crypto stream, maximum allowed %d", protocol.MaxCryptoStreamOffset+1, protocol.MaxCryptoStreamOffset)))
+			Expect(err).To(MatchError(fmt.Sprintf("CRYPTO_BUFFER_EXCEEDED: received invalid offset %d on crypto stream, maximum allowed %d", protocol.MaxCryptoStreamOffset+1, protocol.MaxCryptoStreamOffset)))
 		})
 
 		It("handles messages split over multiple CRYPTO frames", func() {
diff --git a/internal/qerr/error_codes.go b/internal/qerr/error_codes.go
index 426133961..133725009 100644
--- a/internal/qerr/error_codes.go
+++ b/internal/qerr/error_codes.go
@@ -23,6 +23,7 @@ const (
 	VersionNegotiationError ErrorCode = 0x9
 	ProtocolViolation       ErrorCode = 0xa
 	InvalidMigration        ErrorCode = 0xc
+	CryptoBufferExceeded    ErrorCode = 0xd
 )
 
 func (e ErrorCode) isCryptoError() bool {
@@ -71,6 +72,8 @@ func (e ErrorCode) String() string {
 		return "PROTOCOL_VIOLATION"
 	case InvalidMigration:
 		return "INVALID_MIGRATION"
+	case CryptoBufferExceeded:
+		return "CRYPTO_BUFFER_EXCEEDED"
 	default:
 		if e.isCryptoError() {
 			return "CRYPTO_ERROR"