diff --git a/src/internal.c b/src/internal.c
index 7128ce7..1cbd2f6 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -2331,7 +2331,8 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
         }
         /* Add a pad byte if the mpint has the MSB set. */
         if (ret == 0) {
-            if (ssh->handshake->primeGroup[0] & 0x80)
+            if (ssh->handshake->primeGroup != NULL &&
+                    ssh->handshake->primeGroup[0] & 0x80)
                 primeGroupPad = 1;
 
             /* Hash in the length of the GEX prime group. */
diff --git a/src/ssh.c b/src/ssh.c
index 7f5f85e..63b8f81 100644
--- a/src/ssh.c
+++ b/src/ssh.c
@@ -496,6 +496,10 @@ int wolfSSH_connect(WOLFSSH* ssh)
             /* no break */
 
         case CONNECT_SERVER_KEXINIT_DONE:
+            if (ssh->handshake == NULL) {
+                return WS_FATAL_ERROR;
+            }
+
             if (ssh->handshake->kexId == ID_DH_GEX_SHA256)
                 ssh->error = SendKexDhGexRequest(ssh);
             else