diff --git a/doc/newsfragments/close-failed-handshake-connections.bugfix b/doc/newsfragments/close-failed-handshake-connections.bugfix
new file mode 100644
index 00000000..0dc8c16c
--- /dev/null
+++ b/doc/newsfragments/close-failed-handshake-connections.bugfix
@@ -0,0 +1,6 @@
+SECURITY ISSUE
+
+Barrier will now correctly close connections when the app-level handshake fails (fixes CVE-2021-42075).
+
+Previously repeated failing connections would leak file descriptors leading to Barrier being unable
+to receive new connections from clients.
diff --git a/src/lib/server/ClientListener.cpp b/src/lib/server/ClientListener.cpp
index 8f3f7400..a29ae26f 100644
--- a/src/lib/server/ClientListener.cpp
+++ b/src/lib/server/ClientListener.cpp
@@ -195,6 +195,11 @@ ClientListener::handleUnknownClient(const Event&, void* vclient)
                             new TMethodEventJob<ClientListener>(this,
                                 &ClientListener::handleClientDisconnected,
                                 client));
+    } else {
+        auto* stream = unknownClient->getStream();
+        if (stream) {
+            stream->close();
+        }
     }
 
     // now finished with unknown client