diff --git a/source/client/src/clientTmq.c b/source/client/src/clientTmq.c
index c3867f2821..b8474dd9f3 100644
--- a/source/client/src/clientTmq.c
+++ b/source/client/src/clientTmq.c
@@ -2088,6 +2088,7 @@ static void* tmqHandleAllRsp(tmq_t* tmq, int64_t timeout) {
         taosWUnLockLatch(&tmq->lock);
       }
       setVgIdle(tmq, pollRspWrapper->topicName, pollRspWrapper->vgId);
+      tmqFreeRspWrapper(pRspWrapper);
       taosFreeQitem(pRspWrapper);
     } else if (pRspWrapper->tmqRspType == TMQ_MSG_TYPE__POLL_DATA_RSP) {
       SMqPollRspWrapper* pollRspWrapper = (SMqPollRspWrapper*)pRspWrapper;
@@ -2789,6 +2790,7 @@ int32_t askEpCb(void* param, SDataBuf* pMsg, int32_t code) {
     pWrapper->epoch = head->epoch;
     (void)memcpy(&pWrapper->msg, pMsg->pData, sizeof(SMqRspHead));
     if (tDecodeSMqAskEpRsp(POINTER_SHIFT(pMsg->pData, sizeof(SMqRspHead)), &pWrapper->msg) == NULL){
+      tmqFreeRspWrapper((SMqRspWrapper*)pWrapper);
       taosFreeQitem(pWrapper);
     }else{
       (void)taosWriteQitem(tmq->mqueue, pWrapper);
diff --git a/source/common/src/tmsg.c b/source/common/src/tmsg.c
index 4015701a29..3b2672f5a2 100644
--- a/source/common/src/tmsg.c
+++ b/source/common/src/tmsg.c
@@ -10068,6 +10068,7 @@ void *tDecodeMqSubTopicEp(void *buf, SMqSubTopicEp *pTopicEp) {
     buf = tDecodeSMqSubVgEp(buf, &vgEp);
     if (taosArrayPush(pTopicEp->vgs, &vgEp) == NULL) {
       taosArrayDestroy(pTopicEp->vgs);
+      pTopicEp->vgs = NULL;
       return NULL;
     }
   }