diff --git a/Cargo.lock b/Cargo.lock
index 4085c0297..51e6036f7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1107,6 +1107,7 @@ dependencies = [
  "futures",
  "gethostname",
  "getrandom 0.4.3",
+ "http-body-util",
  "libc",
  "log",
  "nanoid",
diff --git a/Changelog.md b/Changelog.md
index 9cc440c25..18b0bbbde 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -25,6 +25,7 @@
 <summary><strong> 🐞 修复问题 </strong></summary>
 
 - 修复检测更新后又发布新版时，应用内更新失败
+- 修复订阅响应过大导致内存占用过高，限制单次下载为 4 MiB
 - 修复全局模式默认停在 `DIRECT` 或 `REJECT` 导致流量未经代理，现自动切换到第一个策略组
 - 修复订阅中未加引号的 REALITY `short-id`（如 `1234e123`）被误读为数字，导致订阅无法启用
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 671d2c214..f6e3d7c37 100755
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -64,6 +64,7 @@ dunce = "1.0.5"
 nanoid = "0.5"
 chrono = { workspace = true }
 boa_engine = "0.22.0"
+http-body-util = "0.1.4"
 percent-encoding = "2.3.2"
 reqwest = { workspace = true }
 sysproxy = { git = "https://github.com/clash-verge-rev/sysproxy-rs.git", branch = "main", features = [
diff --git a/src-tauri/src/utils/network.rs b/src-tauri/src/utils/network.rs
index 89d2ddc6f..1eba283ed 100644
--- a/src-tauri/src/utils/network.rs
+++ b/src-tauri/src/utils/network.rs
@@ -228,6 +228,11 @@ impl NetworkManager {
             }
         };
 
+        let response: tauri::http::Response<reqwest::Body> = response.into();
+        let response = reqwest::Response::from(
+            response.map(|body| reqwest::Body::wrap(http_body_util::Limited::new(body, 4 * 1024 * 1024))),
+        );
+
         let status = response.status();
         let headers = response.headers().to_owned();
         let body = match response.text().await {