diff --git a/doc/Changelog b/doc/Changelog
index d12c9bf81..be3ae39db 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -21,6 +21,9 @@
 	- Fix that a signed wildcard NSEC, is checked before use,
 	  so it does not allow insecure DS proofs inappropriately.
 	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix that after malloc failure a half-built local_alias does
+	  not crash the server. Thanks to Qifan Zhang, Palo Alto
+	  Networks, for the report.
 
 15 June 2026: Wouter
 	- Fix to add `max-transfer-size` and `max-transfer-time` that
diff --git a/services/localzone.c b/services/localzone.c
index c503fd8aa..a5c11faf5 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -1569,13 +1569,17 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 			return 0; /* out of memory */
 		qinfo->local_alias->rrset = regional_alloc_init(
 			temp, lr->rrset, sizeof(*lr->rrset));
-		if(!qinfo->local_alias->rrset)
+		if(!qinfo->local_alias->rrset) {
+			qinfo->local_alias = NULL;
 			return 0; /* out of memory */
+		}
 		qinfo->local_alias->rrset->rk.dname = qinfo->qname;
 		qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
 		get_cname_target(lr->rrset, &ctarget, &ctargetlen);
-		if(!ctargetlen)
+		if(!ctargetlen) {
+			qinfo->local_alias = NULL;
 			return 0; /* invalid cname */
+		}
 		if(dname_is_wild(ctarget)) {
 			/* synthesize cname target */
 			struct packed_rrset_data* d, *lr_d;
@@ -1604,8 +1608,10 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 				sizeof(struct packed_rrset_data) + sizeof(size_t) +
 				sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
 				+ newtargetlen);
-			if(!d)
+			if(!d) {
+				qinfo->local_alias = NULL;
 				return 0; /* out of memory */
+			}
 			lr_d = (struct packed_rrset_data*)lr->rrset->entry.data;
 			qinfo->local_alias->rrset->entry.data = d;
 			d->ttl = lr_d->rr_ttl[0]; /* RFC6672-like behavior:
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 81f880012..0beb893c3 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -1506,8 +1506,12 @@ struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code)
 int local_alias_shallow_copy_qname(struct local_rrset* local_alias, uint8_t** qname,
 	size_t* qname_len)
 {
-	struct ub_packed_rrset_key* rrset = local_alias->rrset;
-	struct packed_rrset_data* d = rrset->entry.data;
+	struct ub_packed_rrset_key* rrset;
+	struct packed_rrset_data* d;
+	rrset = local_alias->rrset;
+	if(!rrset) return 0;
+	d = rrset->entry.data;
+	if(!d) return 0;
 
 	/* Sanity check: our current implementation only supports
 	    * a single CNAME RRset as a local alias. */