diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
index 1bd0f61..cf3f284 100644
--- a/ssl/tls13_client.c
+++ b/ssl/tls13_client.c
@@ -419,6 +419,7 @@
   if (!CBS_get_u16_length_prefixed(&cbs, &extensions) ||
       CBS_len(&cbs) != 0) {
     ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+    sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     return ssl_hs_error;
   }