diff --git a/CHANGES b/CHANGES
index 08289bf25b..b760fee336 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,9 @@
 
+2.6-713 | 2019-07-30 18:12:49 +0000
+
+  * Fix memory leaks in expire_func introduced by recent changes (Jon
+    Siwek, Corelight)
+
 2.6-711 | 2019-07-29 20:15:27 -0700
 
   * Fix duplicate TCP packets not being detected as retransmissions (Jeff Barber)
diff --git a/VERSION b/VERSION
index 73531621a5..be79d9bda7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.6-711
+2.6-713
diff --git a/src/Val.cc b/src/Val.cc
index 380b7d23be..b8313c6a50 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -2339,24 +2339,27 @@ double TableVal::CallExpireFunc(Val* idx)
 			{
 			if ( ! any_idiom )
 				{
-				const val_list* vl0 = idx->AsListVal()->Vals();
 				for ( const auto& v : *idx->AsListVal()->Vals() )
 					vl.append(v->Ref());
+
+				Unref(idx);
 				}
 			else
 				{
 				ListVal* idx_list = idx->AsListVal();
 				// Flatten if only one element
-				if (idx_list->Length() == 1)
-					idx = idx_list->Index(0);
+				if ( idx_list->Length() == 1 )
+					{
+					Val* old = idx;
+					idx = idx_list->Index(0)->Ref();
+					Unref(old);
+					}
 
-				vl.append(idx->Ref());
+				vl.append(idx);
 				}
 			}
 		else
-			{
-			vl.append(idx->Ref());
-			}
+			vl.append(idx);
 
 		Val* result = 0;