diff --git a/CHANGELOG b/CHANGELOG
index c93f71b..471c520 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,8 @@
+2020-09-25
+    - 2.20.2
+    - [BUGFIX] Memory leak: free pushed promise when refcnt is zero.
+    - [BUGFIX] Memory leak in IETF full conn dtor: cleanup closed IDs sets.
+
 2020-09-23
     - 2.20.1
     - [BUGFIX] Typo in new "validate peer addr by DCID" code.  It is
diff --git a/docs/conf.py b/docs/conf.py
index 1ebcd55..060c74d 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'2.20'
 # The full version, including alpha/beta/rc tags
-release = u'2.20.1'
+release = u'2.20.2'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index 5cf5ea4..8b1e96a 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 20
-#define LSQUIC_PATCH_VERSION 1
+#define LSQUIC_PATCH_VERSION 2
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/lsquic_full_conn_ietf.c b/src/liblsquic/lsquic_full_conn_ietf.c
index f3b2c9f..146f61d 100644
--- a/src/liblsquic/lsquic_full_conn_ietf.c
+++ b/src/liblsquic/lsquic_full_conn_ietf.c
@@ -2973,6 +2973,8 @@ ietf_full_conn_ci_destroy (struct lsquic_conn *lconn)
         if (conn->ifc_pub.u.ietf.promises)
             lsquic_hash_destroy(conn->ifc_pub.u.ietf.promises);
     }
+    for (i = 0; i < N_SITS; ++i)
+        lsquic_set64_cleanup(&conn->ifc_closed_stream_ids[i]);
     lsquic_hash_destroy(conn->ifc_pub.all_streams);
     EV_LOG_CONN_EVENT(LSQUIC_LOG_CONN_ID, "full connection destroyed");
     free(conn->ifc_errmsg);
diff --git a/src/liblsquic/lsquic_push_promise.h b/src/liblsquic/lsquic_push_promise.h
index fff12c2..73e1b91 100644
--- a/src/liblsquic/lsquic_push_promise.h
+++ b/src/liblsquic/lsquic_push_promise.h
@@ -2,17 +2,13 @@
 #ifndef LSQUIC_PUSH_PROMISE_H
 #define LSQUIC_PUSH_PROMISE_H 1
 
-struct lsquic_hash_elem;
-struct lsquic_stream;
-
 
 struct push_promise
 {
     /* A push promise is associated with a single stream, while a stream can
      * have several push promises it depends on.  These push promises are
      * stored on a list.  A push promise is destroyed when the dependent
-     * stream is destroyed.  This bounds the amount of time when DUPLICATE_PUSH
-     * frames can be sent out.
+     * stream is destroyed.
      */
     SLIST_ENTRY(push_promise)   pp_next;
     /* Push promises are stored a hash and can be searched by ID */
@@ -62,7 +58,7 @@ struct push_promise
             LSQ_DEBUG("destroy push promise %"PRIu64, (promise_)->pp_id);   \
             if ((promise_)->pp_hash_id.qhe_flags & QHE_HASHED)              \
                 lsquic_hash_erase(all_promises_, &(promise_)->pp_hash_id);  \
-            free(promise);                                                  \
+            free(promise_);                                                 \
         }                                                                   \
     }                                                                       \
     else                                                                    \