diff --git a/CHANGES b/CHANGES
index 91bd204071c15b957259ebe84453755c76584250..9c31009fa046957f07a24b6b013a103030b93171 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4843.	[bug]		dnssec-signzone free hashlist on exit. [RT #46791]
+
 4842.	[bug]		Conditionally compile opensslecdsa_link.c to avoid
 			warnings about unused function. [RT #46790]
 
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index f09e8efa276225ef7d1b68abe5694d038eb6056f..f9b295be4b0cb1184fc2ea5f009cf067314cec90 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -718,6 +718,17 @@ hashlist_init(hashlist_t *l, unsigned int nodes, unsigned int length) {
 	}
 }
 
+static void
+hashlist_free(hashlist_t *l) {
+	if (l->hashbuf) {
+		free(l->hashbuf);
+		l->hashbuf = NULL;
+		l->entries = 0;
+		l->length = 0;
+		l->size = 0;
+	}
+}
+
 static void
 hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)
 {
@@ -3753,6 +3764,9 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);
 
+	if (IS_NSEC3)
+		hashlist_free(&hashlist);
+
 	while (!ISC_LIST_EMPTY(keylist)) {
 		key = ISC_LIST_HEAD(keylist);
 		ISC_LIST_UNLINK(keylist, key, link);