From 7bf9b6bad8dd331a9f0580d55295af02f882722c Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 19 Jun 2026 14:34:25 +0200
Subject: [PATCH] x509: Avoid memory leak if multiple nonce extensions are
 found in OCSP response

---
 src/libstrongswan/plugins/x509/x509_ocsp_response.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libstrongswan/plugins/x509/x509_ocsp_response.c b/src/libstrongswan/plugins/x509/x509_ocsp_response.c
index 820e4ceba..40608ac6b 100644
--- a/src/libstrongswan/plugins/x509/x509_ocsp_response.c
+++ b/src/libstrongswan/plugins/x509/x509_ocsp_response.c
@@ -728,6 +728,7 @@ static bool parse_basicOCSPResponse(private_x509_ocsp_response_t *this,
 					asn1_parse_simple_object(&object, ASN1_OCTET_STRING,
 										parser->get_level(parser)+1, "nonce"))
 				{
+					chunk_free(&this->nonce);
 					this->nonce = chunk_clone(object);
 				}
 				break;