diff --git a/lib/hx509/req.c b/lib/hx509/req.c
index e7e94551b..d8605416b 100644
--- a/lib/hx509/req.c
+++ b/lib/hx509/req.c
@@ -921,6 +921,7 @@ hx509_request_parse_der(hx509_context context,
             continue;
 
         av = a->value.val;
+	free_Extensions(&exts);   /* keep last instance of extension, if multiple included */
         ret = decode_Extensions(av->data, av->length, &exts, NULL);
         if (ret) {
             hx509_set_error_string(context, 0, ret,