diff --git a/core/src/main/kotlin/net/corda/core/contracts/Structures.kt b/core/src/main/kotlin/net/corda/core/contracts/Structures.kt
index 770d34dc76..aa3adc8dcb 100644
--- a/core/src/main/kotlin/net/corda/core/contracts/Structures.kt
+++ b/core/src/main/kotlin/net/corda/core/contracts/Structures.kt
@@ -481,8 +481,17 @@ interface UpgradedContract<in OldState : ContractState, out NewState : ContractS
  * - Facts generated by oracles which might be reused a lot
  */
 interface Attachment : NamedByHash {
+
     fun open(): InputStream
-    fun openAsJAR() = JarInputStream(open())
+
+    fun openAsJAR(): JarInputStream {
+        val stream = open()
+        try {
+            return JarInputStream(stream)
+        } catch (t: Throwable) {
+            stream.use { throw t }
+        }
+    }
 
     /**
      * Finds the named file case insensitively and copies it to the output stream.
@@ -501,6 +510,6 @@ interface Attachment : NamedByHash {
                 jar.closeEntry()
             }
         }
-        throw FileNotFoundException()
+        throw FileNotFoundException(path)
     }
 }
diff --git a/core/src/test/kotlin/net/corda/core/contracts/StructuresTests.kt b/core/src/test/kotlin/net/corda/core/contracts/StructuresTests.kt
new file mode 100644
index 0000000000..be9314793b
--- /dev/null
+++ b/core/src/test/kotlin/net/corda/core/contracts/StructuresTests.kt
@@ -0,0 +1,41 @@
+package net.corda.core.contracts
+
+import com.nhaarman.mockito_kotlin.doAnswer
+import com.nhaarman.mockito_kotlin.spy
+import com.nhaarman.mockito_kotlin.whenever
+import org.junit.Test
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.util.jar.JarFile.MANIFEST_NAME
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
+import kotlin.test.assertEquals
+import kotlin.test.fail
+
+class AttachmentTest {
+
+    @Test
+    fun `openAsJAR does not leak file handle if attachment has corrupted manifest`() {
+        var closeCalls = 0
+        val inputStream = spy(ByteArrayOutputStream().apply {
+            ZipOutputStream(this).use {
+                with(it) {
+                    putNextEntry(ZipEntry(MANIFEST_NAME))
+                    write(ByteArray(512)) // One byte above the limit.
+                }
+            }
+        }.toByteArray().inputStream()).apply { doAnswer { closeCalls += 1 }.whenever(this).close() }
+        val attachment = object : Attachment {
+            override val id get() = throw UnsupportedOperationException()
+            override fun open() = inputStream
+        }
+        try {
+            attachment.openAsJAR()
+            fail("Expected line too long.")
+        } catch (e: IOException) {
+            assertEquals("line too long", e.message)
+        }
+        assertEquals(1, closeCalls)
+    }
+
+}
diff --git a/node/build.gradle b/node/build.gradle
index 17ede82ba4..50ee64f020 100644
--- a/node/build.gradle
+++ b/node/build.gradle
@@ -107,7 +107,6 @@ dependencies {
     testCompile "junit:junit:$junit_version"
     testCompile "org.assertj:assertj-core:${assertj_version}"
     testCompile "com.pholser:junit-quickcheck-core:$quickcheck_version"
-    testCompile "com.nhaarman:mockito-kotlin:1.1.0"
     testCompile project(':test-utils')
     testCompile project(':client:jfx')
 
diff --git a/test-utils/build.gradle b/test-utils/build.gradle
index 826a3a92e5..b4c5c8bbb4 100644
--- a/test-utils/build.gradle
+++ b/test-utils/build.gradle
@@ -25,6 +25,7 @@ dependencies {
 
     // Unit testing helpers.
     compile "junit:junit:$junit_version"
+    compile "com.nhaarman:mockito-kotlin:1.1.0"
 
     // Guava: Google test library (collections test suite)
     compile "com.google.guava:guava-testlib:$guava_version"