The call to MHD_basic_auth_get_username_password allocates memory for both the password and the username. mxs_json_add_relation leaked a reference to a JSON object by using json_array_append instead of json_array_append_new.