diff --git a/src/libosmo-mgcp/mgcp_conn.c b/src/libosmo-mgcp/mgcp_conn.c
index cc115a9..62cbdba 100644
--- a/src/libosmo-mgcp/mgcp_conn.c
+++ b/src/libosmo-mgcp/mgcp_conn.c
@@ -201,6 +201,12 @@
 	if (!conn)
 		return;
 
+	/* Run endpoint cleanup action. By this we inform the endpoint about
+	 * the removal of the connection and allow it to clean up its inner
+	 * state accordingly */
+	if (endp->type->cleanup_cb)
+		endp->type->cleanup_cb(endp, conn);
+
 	switch (conn->type) {
 	case MGCP_CONN_TYPE_RTP:
 		osmux_disable_conn(&conn->u.rtp);
diff --git a/src/libosmo-mgcp/mgcp_endp.c b/src/libosmo-mgcp/mgcp_endp.c
index 6d3a6d4..fa2dd28 100644
--- a/src/libosmo-mgcp/mgcp_endp.c
+++ b/src/libosmo-mgcp/mgcp_endp.c
@@ -28,7 +28,8 @@
 const struct mgcp_endpoint_typeset ep_typeset = {
 	/* Specify endpoint properties for RTP endpoint */
 	.rtp.max_conns = 2,
-	.rtp.dispatch_rtp_cb = mgcp_dispatch_rtp_bridge_cb
+	.rtp.dispatch_rtp_cb = mgcp_dispatch_rtp_bridge_cb,
+	.rtp.cleanup_cb = mgcp_cleanup_rtp_bridge_cb
 };
 
 /*! release endpoint, all open connections are closed.
diff --git a/src/libosmo-mgcp/mgcp_network.c b/src/libosmo-mgcp/mgcp_network.c
index ef6357b..6923b97 100644
--- a/src/libosmo-mgcp/mgcp_network.c
+++ b/src/libosmo-mgcp/mgcp_network.c
@@ -1043,6 +1043,25 @@
 
 }
 
+/*! cleanup an endpoint when a connection on an RTP bridge endpoint is removed.
+ *  \param[in] endp Endpoint on which the connection resides.
+ *  \param[in] conn Connection that is about to be removed (ignored).
+ *  \returns 0 on success, -1 on ERROR. */
+void mgcp_cleanup_rtp_bridge_cb(struct mgcp_endpoint *endp, struct mgcp_conn *conn)
+{
+	struct mgcp_conn *conn_cleanup;
+
+	/* In mgcp_dispatch_rtp_bridge_cb() we use conn->priv to cache the
+	 * pointer to the destination connection, so that we do not have
+	 * to go through the list every time an RTP packet arrives. To prevent
+	 * a use-after-free situation we invalidate this information for all
+	 * connections present when one connection is removed from the
+	 * endpoint. */
+	llist_for_each_entry(conn_cleanup, &endp->conns, entry) {
+		conn_cleanup->priv = NULL;
+	}
+}
+
 /* Handle incoming RTP data from NET */
 static int rtp_data_net(struct osmo_fd *fd, unsigned int what)
 {