diff --git a/src/userauth.c b/src/userauth.c
index 7bdc5775..51463e10 100644
--- a/src/userauth.c
+++ b/src/userauth.c
@@ -214,6 +214,7 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
 
         methods_len = ssh2_ntohu32(session->userauth_list_data + 1);
         if(methods_len >= session->userauth_list_data_len - 5) {
+            SSH2_SAFEFREE(session, session->userauth_list_data);
             ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
                      "Unexpected userauth list size");
             return NULL;