diff --git a/source/client/src/clientTmq.c b/source/client/src/clientTmq.c
index 197a65add8..8f35a2fad1 100644
--- a/source/client/src/clientTmq.c
+++ b/source/client/src/clientTmq.c
@@ -2141,6 +2141,7 @@ static void* tmqHandleAllRsp(tmq_t* tmq, int64_t timeout) {
         taosWUnLockLatch(&tmq->lock);
       }
       setVgIdle(tmq, pollRspWrapper->topicName, pollRspWrapper->vgId);
+      tmqFreeRspWrapper(pRspWrapper);
       taosFreeQitem(pRspWrapper);
     } else if (pRspWrapper->tmqRspType == TMQ_MSG_TYPE__POLL_DATA_RSP) {
       SMqPollRspWrapper* pollRspWrapper = (SMqPollRspWrapper*)pRspWrapper;
@@ -2844,6 +2845,7 @@ int32_t askEpCb(void* param, SDataBuf* pMsg, int32_t code) {
     pWrapper->epoch = head->epoch;
     (void)memcpy(&pWrapper->msg, pMsg->pData, sizeof(SMqRspHead));
     if (tDecodeSMqAskEpRsp(POINTER_SHIFT(pMsg->pData, sizeof(SMqRspHead)), &pWrapper->msg) == NULL){
+      tmqFreeRspWrapper((SMqRspWrapper*)pWrapper);
       taosFreeQitem(pWrapper);
     }else{
       (void)taosWriteQitem(tmq->mqueue, pWrapper);
diff --git a/source/common/src/tmsg.c b/source/common/src/tmsg.c
index 94eb2047c2..740e517e35 100644
--- a/source/common/src/tmsg.c
+++ b/source/common/src/tmsg.c
@@ -10140,6 +10140,7 @@ void *tDecodeMqSubTopicEp(void *buf, SMqSubTopicEp *pTopicEp) {
     buf = tDecodeSMqSubVgEp(buf, &vgEp);
     if (taosArrayPush(pTopicEp->vgs, &vgEp) == NULL) {
       taosArrayDestroy(pTopicEp->vgs);
+      pTopicEp->vgs = NULL;
       return NULL;
     }
   }