diff --git a/openssh-6.7p1-coverity.patch b/openssh-6.7p1-coverity.patch
index b717208..6852384 100644
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@@ -421,6 +421,30 @@ diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c
  				continue;
  			}
  			lname = ls_file(fname, g.gl_statv[i], 1,
+diff --git a/sftp-client.c b/sftp-client.c
+index 9de9afa20f..ea98d9f8d0 100644
+--- a/sftp-client.c
++++ b/sftp-client.c
+@@ -2195,6 +2195,7 @@ handle_dest_replies(struct sftp_conn *to, const char *to_path, int synchronous,
+ 		(*nreqsp)--;
+ 	}
+ 	debug3_f("done: %u outstanding replies", *nreqsp);
++	sshbuf_free(msg);
+ }
+ 
+ int
+diff --git a/sftp-server.c b/sftp-server.c
+index 18d1949112..6380c4dd23 100644
+--- a/sftp-server.c
++++ b/sftp-server.c
+@@ -1553,6 +1553,7 @@ process_extended_expand(u_int32_t id)
+ 			npath = xstrdup(path + 2);
+ 			free(path);
+ 			xasprintf(&path, "%s/%s", cwd, npath);
++			free(npath);
+ 		} else {
+ 			/* ~user expansions */
+ 			if (tilde_expand(path, pw->pw_uid, &npath) != 0) {
 diff -up openssh-8.5p1/sk-usbhid.c.coverity openssh-8.5p1/sk-usbhid.c
 --- openssh-8.5p1/sk-usbhid.c.coverity	2021-03-02 11:31:47.000000000 +0100
 +++ openssh-8.5p1/sk-usbhid.c	2021-03-24 12:03:33.786968187 +0100
diff --git a/openssh.spec b/openssh.spec
index 4e88ddb..da665e7 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -51,7 +51,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.7p1
-%global openssh_rel 3
+%global openssh_rel 4
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 4
 
@@ -661,6 +661,10 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Mon Oct 25 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-4
+- Fix memory leaks introduced in OpenSSH 8.7
+  Related: rhbz#2001002
+
 * Tue Oct 19 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-3
 - Disable locale forwarding in default configurations
   Related: rhbz#2002734