diff --git a/tests/api.c b/tests/api.c
index 2e6290f8a..b9e0770fd 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -32956,6 +32956,7 @@ static int test_wolfSSL_EVP_PKEY_new_CMAC_key(void)
 
     AssertNotNull(key = wolfSSL_EVP_PKEY_new_CMAC_key(
         NULL, (const unsigned char *)priv, AES_128_KEY_SIZE, cipher));
+    wolfSSL_EVP_PKEY_free(key);
 
     printf(resultFmt, passed);
 #endif /* defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT) */
diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index db9712b5b..84a4c369e 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -8868,6 +8868,16 @@ void wolfSSL_EVP_PKEY_free(WOLFSSL_EVP_PKEY* key)
                     break;
                 #endif /* HAVE_HKDF */
 
+                #if defined(WOLFSSL_CMAC) && !defined(NO_AES) && \
+                    defined(WOLFSSL_AES_DIRECT)
+                case EVP_PKEY_CMAC:
+                    if (key->cmacCtx != NULL) {
+                        wolfSSL_CMAC_CTX_free(key->cmacCtx);
+                        key->cmacCtx = NULL;
+                    }
+                    break;
+                #endif /* defined(WOLFSSL_CMAC) ... */
+
                 default:
                     break;
             }