diff --git a/ConfigureChecks.cmake b/ConfigureChecks.cmake
index 3530b579..24fed78b 100644
--- a/ConfigureChecks.cmake
+++ b/ConfigureChecks.cmake
@@ -64,6 +64,7 @@ check_include_file(sys/param.h HAVE_SYS_PARAM_H)
 check_include_file(arpa/inet.h HAVE_ARPA_INET_H)
 check_include_file(byteswap.h HAVE_BYTESWAP_H)
 check_include_file(glob.h HAVE_GLOB_H)
+check_include_file(valgrind/valgrind.h HAVE_VALGRIND_VALGRIND_H)
 
 if (WIN32)
   check_include_file(io.h HAVE_IO_H)
@@ -128,6 +129,8 @@ if (OPENSSL_FOUND)
     set(CMAKE_REQUIRED_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY})
     check_function_exists(RAND_priv_bytes HAVE_OPENSSL_RAND_PRIV_BYTES)
 
+    check_function_exists(OPENSSL_ia32cap_loc HAVE_OPENSSL_IA32CAP_LOC)
+
     unset(CMAKE_REQUIRED_INCLUDES)
     unset(CMAKE_REQUIRED_LIBRARIES)
 endif()
diff --git a/config.h.cmake b/config.h.cmake
index e5f92043..f3660c78 100644
--- a/config.h.cmake
+++ b/config.h.cmake
@@ -23,6 +23,9 @@
 /* Define to 1 if you have the <glob.h> header file. */
 #cmakedefine HAVE_GLOB_H 1
 
+/* Define to 1 if you have the <valgrind/valgrind.h> header file. */
+#cmakedefine HAVE_VALGRIND_VALGRIND_H 1
+
 /* Define to 1 if you have the <pty.h> header file. */
 #cmakedefine HAVE_PTY_H 1
 
@@ -112,6 +115,9 @@
 /* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
 #cmakedefine HAVE_OPENSSL_EVP_CIPHER_CTX_NEW 1
 
+/* Define to 1 if you have the `OPENSSL_ia32cap_loc' function. */
+#cmakedefine HAVE_OPENSSL_IA32CAP_LOC 1
+
 /* Define to 1 if you have the `snprintf' function. */
 #cmakedefine HAVE_SNPRINTF 1
 
diff --git a/src/libcrypto.c b/src/libcrypto.c
index 6b454737..b9b45f64 100644
--- a/src/libcrypto.c
+++ b/src/libcrypto.c
@@ -58,6 +58,11 @@
 #define OLD_CRYPTO
 #endif
 
+#if (HAVE_VALGRIND_VALGRIND_H && HAVE_OPENSSL_IA32CAP_LOC)
+#include <valgrind/valgrind.h>
+#define CAN_DISABLE_AESNI
+#endif
+
 #include "libssh/crypto.h"
 
 struct ssh_mac_ctx_struct {
@@ -1059,7 +1064,17 @@ int ssh_crypto_init(void)
             SSLeay_version(SSLeay())
         );
     }
-
+#ifdef CAN_DISABLE_AESNI
+    /*
+     * disable AES-NI when running within Valgrind, because they generate
+     * too many "uninitialized memory access" false positives
+     */
+    if (RUNNING_ON_VALGRIND){
+        SSH_LOG(SSH_LOG_INFO, "Running within Valgrind, disabling AES-NI");
+        /* Bit #57 denotes AES-NI instruction set extension */
+        OPENSSL_ia32cap &= ~(1LL << 57);
+    }
+#endif
     OpenSSL_add_all_algorithms();
 
     for (i = 0; ssh_ciphertab[i].name != NULL; i++) {