From 37d6c14ddf0cdc67e27d32b757de31439646abaf Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Wed, 4 Mar 2026 14:39:33 -0600
Subject: [PATCH] Fix in wolfSSL_CTX_GenerateEchConfig

---
 src/ssl_ech.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/ssl_ech.c b/src/ssl_ech.c
index 55844c354d..717b709274 100644
--- a/src/ssl_ech.c
+++ b/src/ssl_ech.c
@@ -137,6 +137,10 @@ int wolfSSL_CTX_GenerateEchConfig(WOLFSSL_CTX* ctx, const char* publicName,
 
     if (ret != 0) {
         if (newConfig) {
+            if (newConfig->receiverPrivkey != NULL) {
+                wc_HpkeFreeKey(hpke, newConfig->kemId,
+                    newConfig->receiverPrivkey, ctx->heap);
+            }
             XFREE(newConfig->cipherSuites, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
             XFREE(newConfig->publicName, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
             XFREE(newConfig, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);