diff --git a/ChangeLog.d/x509-programs-ip-san.txt b/ChangeLog.d/x509-programs-ip-san.txt
new file mode 100644
index 0000000000..6343777718
--- /dev/null
+++ b/ChangeLog.d/x509-programs-ip-san.txt
@@ -0,0 +1,6 @@
+Bugfix
+   * Fix a stack buffer overflow in the cert_write and cert_req sample
+     programs when an IPv6 address is given in the san parameter. IPv6
+     addresses are now written correctly.
+   * Fix the cert_write and cert_req sample programs writing the last IP
+     address for every IP entry when the san parameter has more than one.
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 38b7af0925..2920a25f91 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -59,7 +59,7 @@ int main(void)
     "                           DNS:value\n"            \
     "                           URI:value\n"            \
     "                           RFC822:value\n"         \
-    "                           IP:value (Only IPv4 is supported)\n" \
+    "                           IP:value (IPv4 or IPv6)\n" \
     "                           DN:list of comma separated key=value pairs\n" \
     "    key_usage=%%s        default: (empty)\n"       \
     "                        Comma-separated-list of values:\n"     \
@@ -150,9 +150,6 @@ int main(int argc, char *argv[])
     mbedtls_ctr_drbg_context ctr_drbg;
     const char *pers = "csr example app";
     mbedtls_x509_san_list *cur, *prev;
-#if defined(MBEDTLS_X509_CRT_PARSE_C)
-    uint8_t ip[4] = { 0 };
-#endif
     /*
      * Set to sane values
      */
@@ -262,15 +259,24 @@ usage:
                     cur->node.type = MBEDTLS_X509_SAN_DNS_NAME;
                 } else if (strcmp(q, "IP") == 0) {
                     size_t ip_addr_len = 0;
+                    /* Each entry needs its own buffer, because the list is
+                     * only written once all entries have been parsed.
+                     * mbedtls_x509_crt_parse_cn_inet_pton() needs 16 bytes. */
+                    unsigned char *ip = mbedtls_calloc(1, 16);
+                    if (ip == NULL) {
+                        mbedtls_printf("Not enough memory for subjectAltName list\n");
+                        goto exit;
+                    }
                     cur->node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
                     ip_addr_len = mbedtls_x509_crt_parse_cn_inet_pton(subtype_value, ip);
                     if (ip_addr_len == 0) {
                         mbedtls_printf("mbedtls_x509_crt_parse_cn_inet_pton failed to parse %s\n",
                                        subtype_value);
+                        mbedtls_free(ip);
                         goto exit;
                     }
-                    cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.p = ip;
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and
@@ -521,6 +527,9 @@ exit:
             mbedtls_free(dn->val.p);
             mbedtls_asn1_free_named_data_list(&dn->next);
         }
+        if (cur->node.type == MBEDTLS_X509_SAN_IP_ADDRESS) {
+            mbedtls_free(cur->node.san.unstructured_name.p);
+        }
         mbedtls_free(cur);
         cur = next;
     }
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index fc47c6fcb0..dc1fe6b03b 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -128,7 +128,7 @@ int main(void)
     "                             DNS:value\n"            \
     "                             URI:value\n"            \
     "                             RFC822:value\n"         \
-    "                             IP:value (Only IPv4 is supported)\n" \
+    "                             IP:value (IPv4 or IPv6)\n" \
     "                             DN:list of comma separated key=value pairs\n" \
     "    authority_identifier=%%s default: 1\n"             \
     "                            Possible values: 0, 1\n"   \
@@ -316,7 +316,6 @@ int main(int argc, char *argv[])
     mbedtls_ctr_drbg_context ctr_drbg;
     const char *pers = "crt example app";
     mbedtls_x509_san_list *cur, *prev;
-    uint8_t ip[4] = { 0 };
     /*
      * Set to sane values
      */
@@ -587,15 +586,24 @@ usage:
                     cur->node.type = MBEDTLS_X509_SAN_DNS_NAME;
                 } else if (strcmp(q, "IP") == 0) {
                     size_t ip_addr_len = 0;
+                    /* Each entry needs its own buffer, because the list is
+                     * only written once all entries have been parsed.
+                     * mbedtls_x509_crt_parse_cn_inet_pton() needs 16 bytes. */
+                    unsigned char *ip = mbedtls_calloc(1, 16);
+                    if (ip == NULL) {
+                        mbedtls_printf("Not enough memory for subjectAltName list\n");
+                        goto exit;
+                    }
                     cur->node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
                     ip_addr_len = mbedtls_x509_crt_parse_cn_inet_pton(subtype_value, ip);
                     if (ip_addr_len == 0) {
                         mbedtls_printf("mbedtls_x509_crt_parse_cn_inet_pton failed to parse %s\n",
                                        subtype_value);
+                        mbedtls_free(ip);
                         goto exit;
                     }
-                    cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.p = ip;
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and
@@ -1021,6 +1029,9 @@ exit:
             mbedtls_free(dn->val.p);
             mbedtls_asn1_free_named_data_list(&dn->next);
         }
+        if (cur->node.type == MBEDTLS_X509_SAN_IP_ADDRESS) {
+            mbedtls_free(cur->node.san.unstructured_name.p);
+        }
         mbedtls_free(cur);
         cur = next;
     }