diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 9cc8166a5..5c4f584ba 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4279,6 +4279,7 @@ static int ssl_sess_new_srv_cb(SSL *ssl, SSL_SESSION *sess)
 		if (s->ssl_ctx.reused_sess[tid].ptr && s->ssl_ctx.reused_sess[tid].allocated_size >= len) {
 			ptr = s->ssl_ctx.reused_sess[tid].ptr;
 		} else {
+			len = (len + 7) & -8; /* round to the nearest 8 bytes */
 			ptr = realloc(s->ssl_ctx.reused_sess[tid].ptr, len);
 			if (!ptr)
 				free(s->ssl_ctx.reused_sess[tid].ptr);