From dc3d7a6c8320bb6bbe0cef0469dda651dd93d4f8 Mon Sep 17 00:00:00 2001
From: Ruby Martin <ruby@wolfssl.com>
Date: Fri, 24 Apr 2026 12:32:33 -0600
Subject: [PATCH] JCE: zero WolfSSLKeyStore PKCS8 private key buffer after
 native check

---
 .../com/wolfssl/provider/jce/WolfSSLKeyStore.java | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java
index 749ee0e1..c6b425f5 100644
--- a/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java
+++ b/src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java
@@ -1459,11 +1459,14 @@ public class WolfSSLKeyStore extends KeyStoreSpi {
         if (pkcs8Key == null || pkcs8Key.length == 0) {
             throw new KeyStoreException("Bad PrivateKey PKCS#8 encoding");
         }
-
-        match = X509CheckPrivateKey(derCert, pkcs8Key);
-        if (!match) {
-            throw new KeyStoreException("X509Certificate does not match " +
-                "provided private key");
+        try {
+            match = X509CheckPrivateKey(derCert, pkcs8Key);
+            if (!match) {
+                throw new KeyStoreException("X509Certificate does not match " +
+                    "provided private key");
+            }
+        } finally {
+            Arrays.fill(pkcs8Key, (byte)0);
         }
     }
 
@@ -1986,7 +1989,7 @@ public class WolfSSLKeyStore extends KeyStoreSpi {
 
         log("KeyStore successfully stored to OutputStream");
 
-        return; 
+        return;
     }
 
     /**