From e74f78536765948c9c45689c7e445ed4773f2dcb Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@twosigma.com>
Date: Mon, 5 Jan 2026 21:36:17 -0600
Subject: [PATCH] hxtool: Fix leak in acert sub-command

---
 lib/hx509/hxtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index 4f1297430..59793d25d 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -3196,6 +3196,8 @@ acert(struct acert_options *opt, int argc, char **argv)
         hx509_err(context, 1, ret, "Matching certificate did not meet "
                   "requirements");
     hx509_cert_free(cert);
+    hx509_query_free(context, q);
+    hx509_certs_free(&certs);
     free(sn);
     return 0;
 }