diff --git a/doc/Changelog b/doc/Changelog
index 3ba74e349..c48609b97 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+25 April 2018: Ralph
+	- Fix memory leak when caching wildcard records for aggressive NSEC use
+
 24 April 2018: Wouter
 	- Fix contrib/fastrpz.patch for this release.
 	- Fix auth https for libev.
diff --git a/services/cache/rrset.c b/services/cache/rrset.c
index 0b41fcd7d..26c1aeb91 100644
--- a/services/cache/rrset.c
+++ b/services/cache/rrset.c
@@ -255,9 +255,11 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	wc_dname[1] = (uint8_t)'*';
 	memmove(wc_dname+2, ce, ce_len);
 
+	free(rrset->rk.dname);
 	rrset->rk.dname_len = ce_len + 2;
 	rrset->rk.dname = (uint8_t*)memdup(wc_dname, rrset->rk.dname_len);
 	if(!rrset->rk.dname) {
+		alloc_special_release(alloc, rrset);
 		log_err("memdup failure in rrset_cache_update_wildcard");
 		return;
 	}