diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
index 19b65488f92..7342c91d203 100644
--- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
+++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
@@ -618,6 +618,13 @@ public class SslConnection extends AbstractConnection
                                     }
                                     else
                                     {
+                                        if (_encryptedInput.hasRemaining())
+                                        {
+                                            // if there are more encrypted bytes,
+                                            // then we need to unwrap more, we don't
+                                            // care if net_filled is zero
+                                            continue;
+                                        }
                                         // we need to wait for more net data
                                         return 0;
                                     }