diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 66b43066f79cda0ec2709da3a0a4a29302979eb6..5e7c3c13ea7452d50e66cbc856c4a6036f23461f 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -36,6 +36,7 @@ This release includes the following bugfixes:
  o Curl_rand: Use a fake entropy for debug builds when CURL_ENTROPY set
  o nss: do not abort on connection failure (failing tests 305 and 404)
  o nss: make the fallback to SSLv3 work again
+ o tool: prevent valgrind from reporting possibly lost memory (nss only)
  o 
 
 This release includes the following known bugs:
diff --git a/src/tool_main.c b/src/tool_main.c
index ef96dc3a4dcd2019fceb68f18fed86390a94c81e..dc980e00c0094f68524bee5bf9eac1243e4c7dbc 100644
--- a/src/tool_main.c
+++ b/src/tool_main.c
@@ -27,6 +27,10 @@
 #include <signal.h>
 #endif
 
+#ifdef USE_NSS
+#include <nspr.h>
+#endif
+
 #define ENABLE_CURLX_PRINTF
 /* use our own printf() functions */
 #include "curlx.h"
@@ -205,6 +209,11 @@ static void main_free(struct GlobalConfig *config)
   curl_global_cleanup();
   convert_cleanup();
   metalink_cleanup();
+#ifdef USE_NSS
+  if(PR_Initialized())
+    /* prevent valgrind from reporting possibly lost memory (fd cache, ...) */
+    PR_Cleanup();
+#endif
   free_config_fields(config);
 
   /* Free the config structures */