diff --git a/src/proto_sockpair.c b/src/proto_sockpair.c
index ef0e725..f83c51b 100644
--- a/src/proto_sockpair.c
+++ b/src/proto_sockpair.c
@@ -280,6 +280,15 @@
 		return SF_ERR_INTERNAL;
 	}
 
+	if (master == 1 && (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)) {
+		ha_alert("Cannot set CLOEXEC on client socket.\n");
+		close(sv[0]);
+		close(sv[1]);
+		conn->err_code = CO_ER_SOCK_ERR;
+		conn->flags |= CO_FL_ERROR;
+		return SF_ERR_INTERNAL;
+	}
+
 	/* if a send_proxy is there, there are data */
 	data |= conn->send_proxy_ofs;
 
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 0c531e6..9bc048b 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -364,6 +364,14 @@
 		return SF_ERR_INTERNAL;
 	}
 
+	if (master == 1 && (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)) {
+		ha_alert("Cannot set CLOEXEC on client socket.\n");
+		close(fd);
+		conn->err_code = CO_ER_SOCK_ERR;
+		conn->flags |= CO_FL_ERROR;
+		return SF_ERR_INTERNAL;
+	}
+
 	if (be->options & PR_O_TCP_SRV_KA)
 		setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
 
diff --git a/src/proto_uxst.c b/src/proto_uxst.c
index 878a10d..965b7cb 100644
--- a/src/proto_uxst.c
+++ b/src/proto_uxst.c
@@ -502,6 +502,14 @@
 		return SF_ERR_INTERNAL;
 	}
 
+	if (master == 1 && (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)) {
+		ha_alert("Cannot set CLOEXEC on client socket.\n");
+		close(fd);
+		conn->err_code = CO_ER_SOCK_ERR;
+		conn->flags |= CO_FL_ERROR;
+		return SF_ERR_INTERNAL;
+	}
+
 	/* if a send_proxy is there, there are data */
 	data |= conn->send_proxy_ofs;