diff --git a/CHANGES b/CHANGES
index 5842b1388c659184ed8eab0d224ab37fd81337c0..12787a5a2d68ac091b9ec03b915a1fb87f9fdc6c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4843.	[bug]		dnssec-signzone free hashlist on exit. [RT #46791]
+
 4842.	[bug]		Conditionally compile opensslecdsa_link.c to avoid
 			warnings about unused function. [RT #46790]
 
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 1a6cf01531887d390d467723028358217d3a0d68..c1f235e73ba39779f89afaade7eafd7d67590780 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -723,6 +723,17 @@ hashlist_init(hashlist_t *l, unsigned int nodes, unsigned int length) {
 	}
 }
 
+static void
+hashlist_free(hashlist_t *l) {
+	if (l->hashbuf) {
+		free(l->hashbuf);
+		l->hashbuf = NULL;
+		l->entries = 0;
+		l->length = 0;
+		l->size = 0;
+	}
+}
+
 static void
 hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)
 {
@@ -3830,6 +3841,9 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);
 
+	if (IS_NSEC3)
+		hashlist_free(&hashlist);
+
 	while (!ISC_LIST_EMPTY(keylist)) {
 		key = ISC_LIST_HEAD(keylist);
 		ISC_LIST_UNLINK(keylist, key, link);