diff --git a/softhsm-2.6.1-uninitialized.patch b/softhsm-2.6.1-uninitialized.patch
new file mode 100644
index 0000000..bcdb4ee
--- /dev/null
+++ b/softhsm-2.6.1-uninitialized.patch
@@ -0,0 +1,12 @@
+diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp
+index d2bf4037a..6eeac6103 100644
+--- a/src/lib/SoftHSM.cpp
++++ b/src/lib/SoftHSM.cpp
+@@ -972,6 +972,7 @@ CK_RV SoftHSM::C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, CK_
+ 	}
+ 	CryptoFactory::i()->recycleAsymmetricAlgorithm(eddsa);
+ #endif
++	pInfo->flags = 0;	// initialize flags
+ 	switch (type)
+ 	{
+ #ifndef WITH_FIPS
diff --git a/softhsm.spec b/softhsm.spec
index 6e11991..24dbe7b 100644
--- a/softhsm.spec
+++ b/softhsm.spec
@@ -12,6 +12,8 @@ Source1: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}
 
 Patch1: softhsm-2.6.1-rh1831086-exit.patch
 Patch2: softhsm-openssl3-tests.patch
+# based on https://github.com/opendnssec/SoftHSMv2/commit/f94aaffc879ade97a51b8e1308af42f86be1885f
+Patch3: softhsm-2.6.1-uninitialized.patch
 
 BuildRequires: make
 BuildRequires: openssl-devel >= 1.0.1k-6, sqlite-devel >= 3.4.2, cppunit-devel
@@ -45,6 +47,7 @@ The devel package contains the libsofthsm include files
 %setup -q -n %{name}-%{version}%{?prever}
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %if 0%{?prever:1} || 0%{?prerelease:1}
    # pre-release or post-release snapshots fixup