diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c
index 93c9a78f..a4c3cd4e 100644
--- a/src/core/tcp_in.c
+++ b/src/core/tcp_in.c
@@ -947,8 +947,9 @@ tcp_receive(struct tcp_pcb *pcb)
 	    /* Chain this pbuf onto the pbuf that we will pass to
 	       the application. */
 	    if(recv_data) {
-	      pbuf_chain(recv_data, cseg->p);
-	    } else {
+              pbuf_chain(recv_data, cseg->p);
+              pbuf_free(cseg->p);
+            } else {
 	      recv_data = cseg->p;
 	    }
 	    cseg->p = NULL;
diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c
index 69abcb16..28bfda2a 100644
--- a/src/core/tcp_out.c
+++ b/src/core/tcp_out.c
@@ -213,6 +213,7 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
 
       /* Chain the headers and data pbufs together. */
       pbuf_chain(seg->p, p);
+      pbuf_free(p);
     }
 
     /* Now that there are more segments queued, we check again if the
@@ -287,6 +288,10 @@ tcp_enqueue(struct tcp_pcb *pcb, void *arg, u16_t len,
     /* Remove TCP header from first segment. */
     pbuf_header(queue->p, -TCP_HLEN);
     pbuf_chain(useg->p, queue->p);
+    /* Free buffer which was merged. Note that the previous pbuf_chain call
+     * will have incremented the ref count, so here the ref count will still
+     * be 1 for the 1 pointer still being used on this buffer. */
+    pbuf_free(queue->p);
     useg->len += queue->len;
     useg->next = queue->next;