diff --git a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/antragraum/AntragraumService.java b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/antragraum/AntragraumService.java
index 3d53b7d39b76702159ec6320ac8071d39e210557..61e1c014c426095a5545596f4d46d8e6d3621903 100644
--- a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/antragraum/AntragraumService.java
+++ b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/antragraum/AntragraumService.java
@@ -36,6 +36,7 @@ import java.util.stream.Stream;
 import jakarta.annotation.PostConstruct;
 
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.opensaml.saml.saml2.core.Response;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -199,7 +200,13 @@ public class AntragraumService {
 	}
 
 	public void getAttachmentContent(AttachmentFileRequest request, PipedOutputStream pipedOutputStream) {
-		verifyAccessToFile(request);
+		try {
+			verifyAccessToFile(request);
+		} catch (RuntimeException e) {
+			IOUtils.closeQuietly(pipedOutputStream);
+			throw e;
+		}
+
 		try (var dataOutput = new DataOutputStream(pipedOutputStream)) {
 			ozgCloudFileService.writeFileDataToStream(OzgCloudFileId.from(request.fileId()), dataOutput);
 		} catch (IOException e) {
diff --git a/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/antragraum/AntragraumServiceTest.java b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/antragraum/AntragraumServiceTest.java
index d26ea850fc931b96402942c8a6327b82e6c3d861..d0fe6486cee6c5e1ef54c0373e004df6f4ab47a1 100644
--- a/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/antragraum/AntragraumServiceTest.java
+++ b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/antragraum/AntragraumServiceTest.java
@@ -15,6 +15,7 @@ import java.util.Optional;
 import java.util.UUID;
 import java.util.stream.Stream;
 
+import org.apache.commons.io.IOUtils;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.DisplayName;
@@ -23,6 +24,7 @@ import org.junit.jupiter.api.Test;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
 import org.mockito.Spy;
 import org.opensaml.saml.saml2.core.Response;
 
@@ -701,6 +703,39 @@ class AntragraumServiceTest {
 			}
 		}
 
+		@Nested
+		class OnRuntimeException {
+
+			private MockedStatic<IOUtils> mockedIOUtils;
+			private RuntimeException exception;
+
+			@BeforeEach
+			@SneakyThrows
+			void setUpMock() {
+				doThrow(exception = new RuntimeException()).when(service).verifyAccessToFile(request);
+				mockedIOUtils = mockStatic(IOUtils.class);
+			}
+
+			@AfterEach
+			void cleanUp() {
+				mockedIOUtils.close();
+			}
+
+			@Test
+			void shouldClosePipedOutPutStream() {
+				try {
+					callGetAttachmentContent();
+				} catch (RuntimeException e) {
+				}
+				mockedIOUtils.verify(() -> IOUtils.closeQuietly(pipedOutputStream));
+			}
+
+			@Test
+			void shouldRethrowException() {
+				assertThatThrownBy(() -> callGetAttachmentContent()).isEqualTo(exception);
+			}
+		}
+
 		@SneakyThrows
 		private void callGetAttachmentContent() {
 			service.getAttachmentContent(request, pipedOutputStream);