diff --git a/src/net/tls.c b/src/net/tls.c
index 52a83393..4ad131c8 100644
--- a/src/net/tls.c
+++ b/src/net/tls.c
@@ -1749,6 +1749,7 @@ static int tls_new_record ( struct tls_session *tls, unsigned int type,
 	list_del ( &iobuf->list );
 	if ( ! list_empty ( rx_data ) ) {
 		DBGC ( tls, "TLS %p overlength non-data record\n", tls );
+		free_iob ( iobuf );
 		return -EINVAL_NON_DATA;
 	}