From 3bba2a6e3eb5eb53f5ba3008c0368b161a7f0bb3 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 9 Jul 2026 16:48:19 -0700 Subject: [PATCH] fix(dh): wipe DH private key from stack --- src/dh/clu_dh.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/dh/clu_dh.c b/src/dh/clu_dh.c index 373ccb1d..f5e05e97 100644 --- a/src/dh/clu_dh.c +++ b/src/dh/clu_dh.c @@ -801,6 +801,9 @@ int wolfCLU_DhParamSetup(int argc, char** argv) XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER); if (outBuf != NULL) XFREE(outBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER); + + /* wipe DH private key material off the stack before returning */ + wolfCLU_ForceZero(priv, sizeof(priv)); } wolfSSL_BIO_free(bioIn);