diff --git a/nova/api/openstack/compute/server_metadata.py b/nova/api/openstack/compute/server_metadata.py
index 68cc188e0d9c..b530ed49248a 100644
--- a/nova/api/openstack/compute/server_metadata.py
+++ b/nova/api/openstack/compute/server_metadata.py
@@ -56,6 +56,9 @@ class Controller(object):
         except (KeyError, TypeError):
             msg = _("Malformed request body")
             raise exc.HTTPBadRequest(explanation=msg)
+        if not isinstance(metadata, dict):
+            msg = _("Malformed request body. metadata must be object")
+            raise exc.HTTPBadRequest(explanation=msg)
 
         context = req.environ['nova.context']
 
@@ -75,6 +78,10 @@ class Controller(object):
             expl = _('Malformed request body')
             raise exc.HTTPBadRequest(explanation=expl)
 
+        if not isinstance(meta_item, dict):
+            msg = _("Malformed request body. meta item must be object")
+            raise exc.HTTPBadRequest(explanation=msg)
+
         if id not in meta_item:
             expl = _('Request body and URI mismatch')
             raise exc.HTTPBadRequest(explanation=expl)
@@ -100,6 +107,10 @@ class Controller(object):
             expl = _('Malformed request body')
             raise exc.HTTPBadRequest(explanation=expl)
 
+        if not isinstance(metadata, dict):
+            msg = _("Malformed request body. metadata must be object")
+            raise exc.HTTPBadRequest(explanation=msg)
+
         context = req.environ['nova.context']
         new_metadata = self._update_instance_metadata(context,
                                                       server_id,
diff --git a/nova/tests/api/openstack/compute/test_server_metadata.py b/nova/tests/api/openstack/compute/test_server_metadata.py
index 71974a95bfa6..327ae101c536 100644
--- a/nova/tests/api/openstack/compute/test_server_metadata.py
+++ b/nova/tests/api/openstack/compute/test_server_metadata.py
@@ -245,6 +245,18 @@ class ServerMetaDataTest(BaseTest):
         self.assertRaises(webob.exc.HTTPBadRequest,
                           self.controller.create, req, self.uuid, body)
 
+    def test_create_item_non_dict(self):
+        self.stubs.Set(nova.db, 'instance_metadata_update',
+                       return_create_instance_metadata)
+        req = fakes.HTTPRequest.blank(self.url + '/key1')
+        req.method = 'PUT'
+        body = {"metadata": None}
+        req.body = jsonutils.dumps(body)
+        req.headers["content-type"] = "application/json"
+
+        self.assertRaises(webob.exc.HTTPBadRequest,
+                          self.controller.create, req, self.uuid, body)
+
     def test_create_item_key_too_long(self):
         self.stubs.Set(nova.db, 'instance_metadata_update',
                        return_create_instance_metadata)
@@ -347,6 +359,18 @@ class ServerMetaDataTest(BaseTest):
         self.assertRaises(webob.exc.HTTPNotFound,
                           self.controller.update_all, req, '100', body)
 
+    def test_update_all_non_dict(self):
+        self.stubs.Set(nova.db, 'instance_metadata_update',
+                       return_create_instance_metadata)
+        req = fakes.HTTPRequest.blank(self.url)
+        req.method = 'PUT'
+        body = {"metadata": None}
+        req.body = jsonutils.dumps(body)
+        req.headers["content-type"] = "application/json"
+
+        self.assertRaises(webob.exc.HTTPBadRequest,
+                          self.controller.update_all, req, self.uuid, body)
+
     def test_update_item(self):
         self.stubs.Set(objects.Instance, 'save', fake_instance_save)
         req = fakes.HTTPRequest.blank(self.url + '/key1')
@@ -442,6 +466,18 @@ class ServerMetaDataTest(BaseTest):
         self.assertRaises(webob.exc.HTTPBadRequest,
                           self.controller.update, req, self.uuid, 'bad', body)
 
+    def test_update_item_non_dict(self):
+        self.stubs.Set(nova.db, 'instance_metadata_update',
+                       return_create_instance_metadata)
+        req = fakes.HTTPRequest.blank(self.url + '/bad')
+        req.method = 'PUT'
+        body = {"meta": None}
+        req.body = jsonutils.dumps(body)
+        req.headers["content-type"] = "application/json"
+
+        self.assertRaises(webob.exc.HTTPBadRequest,
+                          self.controller.update, req, self.uuid, 'bad', body)
+
     def test_too_many_metadata_items_on_create(self):
         self.stubs.Set(nova.db, 'instance_metadata_update',
                        return_create_instance_metadata)