diff --git a/ChangeLog b/ChangeLog
index d26cec2..64aeac5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -44,6 +44,9 @@
      cause buffer bound checks to be bypassed. Found by Eyal Itkin.
    * Fixed heap overreads in mbedtls_x509_get_time(). Found by Peng
      Li/Yueh-Hsun Lin, KNOX Security, Samsung Research America.
+   * Fix potential memory leak in mbedtls_x509_crl_parse(). The leak was caused
+     by missing calls to mbedtls_pem_free() in cases when a
+     MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT error was encountered.
 
 = mbed TLS 2.1.6 branch released 2016-10-17
 
diff --git a/library/x509_crl.c b/library/x509_crl.c
index dca14cc..3af10f6 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -524,16 +524,17 @@
             if( ( ret = mbedtls_x509_crl_parse_der( chain,
                                             pem.buf, pem.buflen ) ) != 0 )
             {
+                mbedtls_pem_free( &pem );
                 return( ret );
             }
-
-            mbedtls_pem_free( &pem );
         }
         else if( is_pem )
         {
             mbedtls_pem_free( &pem );
             return( ret );
         }
+
+        mbedtls_pem_free( &pem );
     }
     /* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
      * And a valid CRL cannot be less than 1 byte anyway. */