diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 24b17f985..ec4aa8f59 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4031,6 +4031,8 @@ ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
 
             ngx_rbtree_delete(&cache->session_rbtree, node);
 
+            ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
             ngx_slab_free_locked(shpool, sess_id->session);
 #endif
@@ -4120,6 +4122,8 @@ ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
 
             ngx_rbtree_delete(&cache->session_rbtree, node);
 
+            ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
             ngx_slab_free_locked(shpool, sess_id->session);
 #endif
@@ -4168,6 +4172,8 @@ ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
 
         ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
 
+        ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
         ngx_slab_free_locked(shpool, sess_id->session);
 #endif