diff -ru dnsdist-2.0.3.orig/doh3.cc dnsdist-2.0.3.CVE-2026-33595/doh3.cc
--- dnsdist-2.0.3.orig/doh3.cc	2026-03-12 16:00:00.000000000 +0100
+++ dnsdist-2.0.3.CVE-2026-33595/doh3.cc	2026-04-03 15:51:33.008135102 +0200
@@ -719,6 +719,8 @@
     ++clientState.nonCompliantQueries;
     ++frontend.d_errorResponses;
     h3_send_response(conn, streamID, 400, msg);
+    conn.d_streamBuffers.erase(streamID);
+    conn.d_headersBuffers.erase(streamID);
   };
 
   auto& headers = conn.d_headersBuffers.at(streamID);
@@ -876,8 +878,11 @@
     }
     case QUICHE_H3_EVENT_FINISHED:
     case QUICHE_H3_EVENT_RESET:
-    case QUICHE_H3_EVENT_PRIORITY_UPDATE:
+      conn.d_headersBuffers.erase(streamID);
+      conn.d_streamBuffers.erase(streamID);
+      break;
     case QUICHE_H3_EVENT_GOAWAY:
+    case QUICHE_H3_EVENT_PRIORITY_UPDATE:
       break;
     }
   }
diff -ru dnsdist-2.0.3.orig/doq.cc dnsdist-2.0.3.CVE-2026-33595/doq.cc
--- dnsdist-2.0.3.orig/doq.cc	2026-03-12 16:00:00.000000000 +0100
+++ dnsdist-2.0.3.CVE-2026-33595/doq.cc	2026-04-03 15:51:33.008238849 +0200
@@ -637,6 +637,7 @@
       ++dnsdist::metrics::g_stats.nonCompliantQueries;
       ++clientState.nonCompliantQueries;
       quiche_conn_stream_shutdown(conn.d_conn.get(), streamID, QUICHE_SHUTDOWN_WRITE, static_cast<uint64_t>(DOQ_Error_Codes::DOQ_PROTOCOL_ERROR));
+      conn.d_streamBuffers.erase(streamID);
       return;
     }
 
@@ -659,6 +660,7 @@
     ++dnsdist::metrics::g_stats.nonCompliantQueries;
     ++clientState.nonCompliantQueries;
     quiche_conn_stream_shutdown(conn.d_conn.get(), streamID, QUICHE_SHUTDOWN_WRITE, static_cast<uint64_t>(DOQ_Error_Codes::DOQ_PROTOCOL_ERROR));
+    conn.d_streamBuffers.erase(streamID);
     return;
   }
 
@@ -668,6 +670,7 @@
     ++dnsdist::metrics::g_stats.nonCompliantQueries;
     ++clientState.nonCompliantQueries;
     quiche_conn_stream_shutdown(conn.d_conn.get(), streamID, QUICHE_SHUTDOWN_WRITE, static_cast<uint64_t>(DOQ_Error_Codes::DOQ_PROTOCOL_ERROR));
+    conn.d_streamBuffers.erase(streamID);
     return;
   }
   DEBUGLOG("Dispatching query");