diff --git a/support/download/cvs b/support/download/cvs
index 3f77b849e4..9d0dc3cb3a 100755
--- a/support/download/cvs
+++ b/support/download/cvs
@@ -33,9 +33,13 @@ done
 shift $((OPTIND-1)) # Get rid of our options
 
 # Caller needs to single-quote its arguments to prevent them from
-# being expanded a second time (in case there are spaces in them)
+# being expanded a second time (in case there are spaces in them).
+# If the CVS server is deadlocked, the client will never return (cfr.
+# http://autobuild.buildroot.net/results/23d/23d1034b33d0354de15de2ec4a8ccd0603e8db78/build-end.log
+# ). Since nobody sane will put large code bases in CVS, a timeout of
+# 10 minutes should do the trick.
 _cvs() {
-    eval ${CVS} "${@}"
+    eval timeout 10m ${CVS} "${@}"
 }
 
 if [[ ${rev} =~ ^[0-9] ]]; then