fixed leak introduced after CVE/upgrade