From de66edb920c2baf8008a8ec00a5946187daa9443 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Wed, 19 Aug 2026 14:22:44 -0600
Subject: [PATCH] F-5035: zeroize PKCS8 spec copy in RSA KeyFactory private key
 decode

---
 .../java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java  | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java
index e2a1d5e9..74a8854e 100644
--- a/src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java
+++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java
@@ -378,6 +378,9 @@ public class WolfCryptRSAKeyFactory extends KeyFactorySpi {
             if (rsa != null) {
                 rsa.releaseNativeStruct();
             }
+            if (pkcs8Der != null) {
+                Arrays.fill(pkcs8Der, (byte)0);
+            }
         }
     }