diff --git a/ChangeLog b/ChangeLog
index 440b06e54..8541eb33a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@
      [sftp.1]
      mention that IPv6 addresses must be enclosed in square brackets;
      bz#1845
+   - djm@cvs.openbsd.org 2011/05/06 02:05:41
+     [sshconnect2.c]
+     fix memory leak; bz#1849 ok dtucker@
 
 20110510
  - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Bug #1882: fix
diff --git a/sshconnect2.c b/sshconnect2.c
index 3cb9b101c..673bf1a4f 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.186 2010/11/29 23:45:51 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.187 2011/05/06 02:05:41 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -1888,9 +1888,12 @@ authmethod_get(char *authlist)
 		    authmethod_is_enabled(current)) {
 			debug3("authmethod_is_enabled %s", name);
 			debug("Next authentication method: %s", name);
+			xfree(name);
 			return current;
 		}
 	}
+	if (name != NULL)
+		xfree(name);
 }
 
 static char *