diff --git a/src/java/org/apache/cassandra/security/EncryptionUtils.java b/src/java/org/apache/cassandra/security/EncryptionUtils.java
index 48868f73c4..97c37f6f96 100644
--- a/src/java/org/apache/cassandra/security/EncryptionUtils.java
+++ b/src/java/org/apache/cassandra/security/EncryptionUtils.java
@@ -257,7 +257,8 @@ public class EncryptionUtils
         {
             int readLength = dst.remaining();
             // we should only be performing encrypt/decrypt operations with on-heap buffers, so calling BB.array() should be legit here
-            fileDataInput.readFully(dst.array(), dst.position(), readLength);
+            fileDataInput.readFully(dst.array(), dst.arrayOffset() + dst.position(), readLength);
+            dst.position(dst.position() + readLength);
             return readLength;
         }
 
diff --git a/src/java/org/apache/cassandra/security/SSLFactory.java b/src/java/org/apache/cassandra/security/SSLFactory.java
index be3b66b1a8..508c8659d6 100644
--- a/src/java/org/apache/cassandra/security/SSLFactory.java
+++ b/src/java/org/apache/cassandra/security/SSLFactory.java
@@ -233,6 +233,7 @@ public final class SSLFactory
      */
     public static void clearSslContextCache()
     {
+        cachedSslContexts.values().forEach(ReferenceCountUtil::release);
         cachedSslContexts.clear();
     }
 
@@ -244,7 +245,11 @@ public final class SSLFactory
         cachedSslContexts.forEachKey(1, cacheKey -> {
             if (Objects.equals(options, cacheKey.encryptionOptions))
             {
-                cachedSslContexts.remove(cacheKey);
+                SslContext ctx = cachedSslContexts.remove(cacheKey);
+                if (ctx != null)
+                {
+                    ReferenceCountUtil.release(ctx);
+                }
                 keysToCheck.remove(cacheKey);
             }
         });