diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index be5e9a4b2..13dfb4932 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -1872,6 +1872,7 @@ _krb5_parse_moduli(krb5_context context, const char *file,
 	*moduli = m;
 	return 0;
     }
+    rk_cloexec_file(f);
 
     while(fgets(buf, sizeof(buf), f) != NULL) {
 	struct krb5_dh_moduli *element;