diff --git a/changelogs/unreleased/gh-9037-fix-heap-use-after-free.md b/changelogs/unreleased/gh-9037-fix-heap-use-after-free.md
new file mode 100644
index 0000000000000000000000000000000000000000..6ee5e8655862c30de7c7fa7050c685ba90eb8650
--- /dev/null
+++ b/changelogs/unreleased/gh-9037-fix-heap-use-after-free.md
@@ -0,0 +1,3 @@
+## bugfix/core
+
+* Fixed a use-after-free bug in iproto server code (gh-9037).
diff --git a/src/box/iproto.cc b/src/box/iproto.cc
index 503a23238e26738cd9aa83972bf9b6522d712d74..e0bb652058b6deec5f811b2619b477a5f0fb33fe 100644
--- a/src/box/iproto.cc
+++ b/src/box/iproto.cc
@@ -2735,8 +2735,9 @@ net_end_join(struct cmsg *m)
 {
 	struct iproto_msg *msg = (struct iproto_msg *) m;
 	struct iproto_connection *con = msg->connection;
+	struct ibuf *ibuf = msg->p_ibuf;
 
-	msg->p_ibuf->rpos += msg->len;
+	ibuf->rpos += msg->len;
 	iproto_msg_delete(msg);
 
 	assert(! ev_is_active(&con->input));
@@ -2744,7 +2745,7 @@ net_end_join(struct cmsg *m)
 	 * Enqueue any messages if they are in the readahead
 	 * queue. Will simply start input otherwise.
 	 */
-	if (iproto_enqueue_batch(con, msg->p_ibuf) != 0)
+	if (iproto_enqueue_batch(con, ibuf) != 0)
 		iproto_connection_close(con);
 }