From 606832e541221e3d147c6b649648cd9a95cc8da0 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 9 Jul 2026 16:48:19 -0700 Subject: [PATCH] fix(dh): wipe DH private key from stack --- src/dh/clu_dh.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/dh/clu_dh.c b/src/dh/clu_dh.c index bae4942b..5f9dc82c 100644 --- a/src/dh/clu_dh.c +++ b/src/dh/clu_dh.c @@ -795,6 +795,9 @@ int wolfCLU_DhParamSetup(int argc, char** argv) XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER); if (outBuf != NULL) XFREE(outBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER); + + /* wipe DH private key material off the stack before returning */ + wolfCLU_ForceZero(priv, sizeof(priv)); } wolfSSL_BIO_free(bioIn);