diff --git a/NEWS b/NEWS
index ea7c00b0..098a4e50 100644
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,7 @@ NEWS
   * fix hex escape in accesslog (fixes #2559)
   * show extforward re-run warning only with debug.log-request-handling (fixes #2561)
   * parse If-None-Match for ETag validation (fixes #2578)
+  * fix memory leak in mod_status when no counters are set (found by coverity)
 
 - 1.4.35 - 2014-03-12
   * [network/ssl] fix build error if TLSEXT is disabled
diff --git a/src/mod_status.c b/src/mod_status.c
index daecb086..708a1690 100644
--- a/src/mod_status.c
+++ b/src/mod_status.c
@@ -622,7 +622,7 @@ static handler_t mod_status_handle_server_status_text(server *srv, connection *c
 }
 
 static handler_t mod_status_handle_server_statistics(server *srv, connection *con, void *p_d) {
-	buffer *b = buffer_init();
+	buffer *b;
 	size_t i;
 	array *st = srv->status;
 	UNUSED(p_d);
@@ -635,6 +635,7 @@ static handler_t mod_status_handle_server_statistics(server *srv, connection *co
 		return HANDLER_FINISHED;
 	}
 
+	b = buffer_init();
 	for (i = 0; i < st->used; i++) {
 		size_t ndx = st->sorted[i];