diff -r 8f4d28ac6ae2 -r bbd82eee568e src/server/daemon/sessionhandler.c
--- a/src/server/daemon/sessionhandler.c	Wed Nov 02 18:08:06 2022 +0100
+++ b/src/server/daemon/sessionhandler.c	Wed Nov 02 18:21:58 2022 +0100
@@ -98,6 +98,7 @@
 }
 
 void connection_destroy(Connection *conn) {
+    cfg_unref(conn->listener->cfg);
     conn->close(conn);
     if(conn->ssl) {
         SSL_free(conn->ssl);
@@ -221,40 +222,68 @@
 }
 
 void evt_enq_conn(SessionHandler *handler, Connection *conn) {
-    HTTPRequest *request = malloc(sizeof(HTTPRequest));
-    http_request_init(request);
-    request->connection = conn;
-    conn->session_handler = handler;
-    
     // set socket non blocking
     int flags;
     if ((flags = fcntl(conn->fd, F_GETFL, 0)) == -1) {
         flags = 0;
     }
     if (fcntl(conn->fd, F_SETFL, flags | O_NONBLOCK) != 0) {
-        perror("Error: start_event_session: fcntl");
-        // TODO: error
+        log_ereport(LOG_FAILURE, "sessionhandler: fcntl failed: %s", strerror(errno));
+        connection_destroy(conn);
+        return;
     }
     
+    HTTPRequest *request = malloc(sizeof(HTTPRequest));
+    if(!request) {
+        connection_destroy(conn);
+        return;
+    }
+    http_request_init(request);
+    request->connection = conn;
+    conn->session_handler = handler;
+    
     // TODO: remove code redundancy (basic_run_session)
     
     // read request
     netbuf *buf = malloc(sizeof(netbuf));
+    if(!buf) {
+        connection_destroy(conn);
+        http_request_cleanup(request);
+        return;
+    }
     buf->rdtimeout = 120;
     buf->pos = 0;
     buf->cursize = 0;
     buf->maxsize = 2048;
     buf->sd = &conn->fd;
+    buf->errmsg = NULL;
     buf->inbuf = malloc(2048);
-    buf->errmsg = NULL;
+    if(!buf->inbuf) {
+        connection_destroy(conn);
+        http_request_cleanup(request);
+        free(buf);
+        return;
+    }
 
     request->netbuf = buf;
     
     HttpParser *parser = http_parser_new(request);
+    if(!parser) {
+        connection_destroy(conn);
+        http_request_cleanup(request);
+        free(buf->inbuf);
+        free(buf);
+        return;
+    }
     
     EventHttpIO *io = malloc(sizeof(EventHttpIO));
     if(io == NULL) {
-        // TODO: error handling
+        connection_destroy(conn);
+        http_request_cleanup(request);
+        free(buf->inbuf);
+        free(buf);
+        http_parser_free(parser);
+        return;
     }
     io->request = request;
     io->parser  = parser;
@@ -277,8 +306,7 @@
     if(ev_pollin(ev, conn->fd, event) != 0) {
         // TODO: ev_pollin should log, intercept some errors here
         log_ereport(LOG_FAILURE, "Cannot enqueue connection");
-        connection_destroy(conn);
-        // TODO: free stuff
+        evt_request_error(ev, event);
     }
 }
 
@@ -390,7 +418,7 @@
     
     if(!http_parser_validate(parser)) {
         log_ereport(LOG_FAILURE, "http_parser_validate failed");
-        // TODO: send error 400 bad request
+        fatal_error(request, 400);
         event->finish = evt_request_error;
         return 0;
     }
@@ -442,7 +470,6 @@
     free(request->netbuf->inbuf);
     free(request->netbuf);
     
-    cfg_unref(request->connection->listener->cfg);
     connection_destroy(request->connection);
     
     http_request_cleanup(request);