diff --git a/ChangeLog b/ChangeLog
index ca2e71780..67da2818c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,9 @@ Security
    * Fix possible heap buffer overflow in base64_encoded() when the input
      buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken,
      Intelworks. Not trigerrable remotely in TLS.
+   * Fix potential double-free if mbedtls_conf_psk() is called repeatedly on
+     the same mbedtls_ssl_config object and memory allocation fails. Found by
+     Guido Vranken, Intelworks. Cannot be forced remotely.
 
 Changes
    * Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 43cbe0fc4..9142be856 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5707,7 +5707,9 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
         ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
     {
         mbedtls_free( conf->psk );
+        mbedtls_free( conf->psk_identity );
         conf->psk = NULL;
+        conf->psk_identity = NULL;
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
     }