diff --git a/ext/openssl/openssl_backend_common.c b/ext/openssl/openssl_backend_common.c
index 0cda27407a5..02210cce8b1 100644
--- a/ext/openssl/openssl_backend_common.c
+++ b/ext/openssl/openssl_backend_common.c
@@ -894,6 +894,7 @@ X509_STORE *php_openssl_setup_verify(zval *calist, uint32_t arg_num)
 		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(calist), item) {
 			zend_string *str = zval_try_get_string(item);
 			if (UNEXPECTED(!str)) {
+				X509_STORE_free(store);
 				return NULL;
 			}
 
diff --git a/ext/openssl/tests/memory_leak_x509_store.phpt b/ext/openssl/tests/memory_leak_x509_store.phpt
new file mode 100644
index 00000000000..bc9b113602a
--- /dev/null
+++ b/ext/openssl/tests/memory_leak_x509_store.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Memory leak of X509_STORE in php_openssl_setup_verify() on failure
+--EXTENSIONS--
+openssl
+--FILE--
+<?php
+
+class MyStringable{
+    public function __toString(): string {
+        throw new Error('stop');
+    }
+}
+
+try {
+    openssl_pkcs7_verify("does not matter", 0, "does not matter", [new MyStringable]);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+stop