diff --git a/src/dh/clu_dh.c b/src/dh/clu_dh.c
index 373ccb1d..f5e05e97 100644
--- a/src/dh/clu_dh.c
+++ b/src/dh/clu_dh.c
@@ -801,6 +801,9 @@ int wolfCLU_DhParamSetup(int argc, char** argv)
             XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (outBuf != NULL)
             XFREE(outBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+
+        /* wipe DH private key material off the stack before returning */
+        wolfCLU_ForceZero(priv, sizeof(priv));
     }
 
     wolfSSL_BIO_free(bioIn);