From fa3feb744227b227d2fc1ce3cf27c119502a2c05 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Fri, 17 Apr 2026 16:46:57 +0200
Subject: [PATCH] Zeroize static ephemeral key buffer before free

F-2144

SetStaticEphemeralKey loaded a private key file into keyBuf and freed it
without ForceZero. Static ephemeral keys are long-lived, so zeroize the
buffer before XFREE.
---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index 0d722f4ae0..05e7a79df3 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -18645,6 +18645,7 @@ static int SetStaticEphemeralKey(WOLFSSL_CTX* ctx,
 #ifndef NO_FILESYSTEM
     /* done with keyFile buffer */
     if (keyFile && keyBuf) {
+        ForceZero(keyBuf, keySz);
         XFREE(keyBuf, heap, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif