diff --git a/NEWS b/NEWS
index 40806102246..d6f38f9adce 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,10 @@ PHP                                                                        NEWS
   . Fix memory leak in intl_datetime_decompose() on failure. (nielsdos)
   . Fix memory leak in locale lookup on failure. (nielsdos)
 
+- OpenSSL:
+  . Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
+    (nielsdos)
+
 - Phar:
   . Add missing filter cleanups on phar failure. (nielsdos)
   . Fixed bug GH-18642 (Signed integer overflow in ext/phar fseek). (nielsdos)
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index c978859b7ec..718f946ad17 100644
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -2421,6 +2421,7 @@ static X509_STORE *php_openssl_setup_verify(zval *calist, uint32_t arg_num)
 		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(calist), item) {
 			zend_string *str = zval_try_get_string(item);
 			if (UNEXPECTED(!str)) {
+				X509_STORE_free(store);
 				return NULL;
 			}
 
diff --git a/ext/openssl/tests/memory_leak_x509_store.phpt b/ext/openssl/tests/memory_leak_x509_store.phpt
new file mode 100644
index 00000000000..bc9b113602a
--- /dev/null
+++ b/ext/openssl/tests/memory_leak_x509_store.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Memory leak of X509_STORE in php_openssl_setup_verify() on failure
+--EXTENSIONS--
+openssl
+--FILE--
+<?php
+
+class MyStringable{
+    public function __toString(): string {
+        throw new Error('stop');
+    }
+}
+
+try {
+    openssl_pkcs7_verify("does not matter", 0, "does not matter", [new MyStringable]);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+stop