From ebd0bf21e08df2501bb2db69bf416e6f08430892 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 7 Apr 2026 13:08:57 -0700
Subject: [PATCH] F-2207 - Add ForceZero of ECC private key before free in
 PKCS#11

---
 wolfcrypt/src/wc_pkcs11.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/wolfcrypt/src/wc_pkcs11.c b/wolfcrypt/src/wc_pkcs11.c
index e44e2a500d..c23213f4ae 100644
--- a/wolfcrypt/src/wc_pkcs11.c
+++ b/wolfcrypt/src/wc_pkcs11.c
@@ -1539,6 +1539,8 @@ static int Pkcs11CreateEccPrivateKey(CK_OBJECT_HANDLE* privateKey,
                 ret = WC_HW_E;
             }
         }
+        if (priv != NULL)
+            ForceZero(priv, privLen);
         XFREE(priv, private_key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     }