diff --git a/crypto/fipsmodule/bn/ctx.c b/crypto/fipsmodule/bn/ctx.c
index 1926e80..f8c7ebf 100644
--- a/crypto/fipsmodule/bn/ctx.c
+++ b/crypto/fipsmodule/bn/ctx.c
@@ -126,6 +126,10 @@
     return;
   }
 
+  // All |BN_CTX_start| calls must be matched with |BN_CTX_end|, otherwise the
+  // function may use more memory than expected, potentially without bound if
+  // done in a loop. Assert that all |BIGNUM|s have been released.
+  assert(ctx->used == 0 || ctx->error);
   sk_BIGNUM_pop_free(ctx->bignums, BN_free);
   BN_STACK_cleanup(&ctx->stack);
   OPENSSL_free(ctx);