From a80d7c7e0c534587e93db494687fb1215e8b95d7 Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 9 Jul 2026 16:48:29 -0700
Subject: [PATCH] fix: zeroize EC private-key DER before free

---
 src/ecparam/clu_ecparam.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/ecparam/clu_ecparam.c b/src/ecparam/clu_ecparam.c
index 31021203..10e0dfb9 100644
--- a/src/ecparam/clu_ecparam.c
+++ b/src/ecparam/clu_ecparam.c
@@ -280,6 +280,9 @@ int wolfCLU_ecparam(int argc, char** argv)
             if (der != NULL) {
                 /* der was created by wolfSSL library so we assume
                  * that XMALLOC was used and call XFREE here */
+                if (derSz > 0) {
+                    wolfCLU_ForceZero(der, derSz);
+                }
                 XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             }
         }