diff --git a/include/tscore/CryptoHash.h b/include/tscore/CryptoHash.h
index 4c2d97e3ff6..02c1f9d7147 100644
--- a/include/tscore/CryptoHash.h
+++ b/include/tscore/CryptoHash.h
@@ -168,26 +168,23 @@ class CryptoContext : public CryptoContextBase
   }; ///< What type of hash we really are.
   static HashType Setting;
 
-  ~CryptoContext()
-  {
-    delete _base;
-    _base = nullptr;
-  }
+  ~CryptoContext() { reinterpret_cast<CryptoContextBase *>(_base)->~CryptoContextBase(); }
 
 private:
-  CryptoContextBase *_base = nullptr;
+  static size_t constexpr OBJ_SIZE = 256;
+  char _base[OBJ_SIZE];
 };
 
 inline bool
 CryptoContext::update(void const *data, int length)
 {
-  return _base->update(data, length);
+  return reinterpret_cast<CryptoContextBase *>(_base)->update(data, length);
 }
 
 inline bool
 CryptoContext::finalize(CryptoHash &hash)
 {
-  return _base->finalize(hash);
+  return reinterpret_cast<CryptoContextBase *>(_base)->finalize(hash);
 }
 
 ts::BufferWriter &bwformat(ts::BufferWriter &w, ts::BWFSpec const &spec, ats::CryptoHash const &hash);
diff --git a/src/tscore/CryptoHash.cc b/src/tscore/CryptoHash.cc
index 8ee07eec11f..211bd1a843d 100644
--- a/src/tscore/CryptoHash.cc
+++ b/src/tscore/CryptoHash.cc
@@ -45,11 +45,13 @@ CryptoContext::CryptoContext()
   case UNSPECIFIED:
 #if TS_ENABLE_FIPS == 0
   case MD5:
-    _base = new MD5Context;
+    static_assert(OBJ_SIZE >= sizeof(MD5Context));
+    new (_base) MD5Context;
     break;
 #else
   case SHA256:
-    _base = new SHA256Context;
+    static_assert(OBJ_SIZE >= sizeof(SHA256Context));
+    new (_base) SHA256Context;
     break;
 #endif
   default: