diff --git a/src/backend.c b/src/backend.c
index 160a2aa..ae0943e 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1477,13 +1477,18 @@
 		}
 	}
 
-	if (!srv_conn)
+	if (!srv_conn) {
+		if (srv_conn)
+			conn_free(srv_conn);
 		return SF_ERR_RESOURCE;
+	}
 
 	if (!(s->flags & SF_ADDR_SET)) {
 		err = assign_server_address(s, srv_conn);
-		if (err != SRV_STATUS_OK)
+		if (err != SRV_STATUS_OK) {
+			conn_free(srv_conn);
 			return SF_ERR_INTERNAL;
+		}
 	}
 
 	if (!conn_xprt_ready(srv_conn) && !srv_conn->mux) {
@@ -1493,11 +1498,15 @@
 		else if (obj_type(s->target) == OBJ_TYPE_PROXY) {
 			/* proxies exclusively run on raw_sock right now */
 			conn_prepare(srv_conn, protocol_by_family(srv_conn->addr.to.ss_family), xprt_get(XPRT_RAW));
-			if (!(srv_conn->ctrl))
+			if (!(srv_conn->ctrl)) {
+				conn_free(srv_conn);
 				return SF_ERR_INTERNAL;
+			}
 		}
-		else
+		else {
+			conn_free(srv_conn);
 			return SF_ERR_INTERNAL;  /* how did we get there ? */
+		}
 
 #if defined(USE_OPENSSL) && defined(TLSEXT_TYPE_application_layer_protocol_negotiation)
 		if (!srv ||