diff --git a/CHANGES b/CHANGES
index 6cee029187..163ab0d0e4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6345.	[bug]		Added missing dns_rdataset_disassociate calls in
+			validator.c:findnsec3proofs. [GL #4571]
+
 6343.	[bug]		Fix case insensitive setting for isc_ht hashtable.
 			[GL #4568]
 
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 56a0ced7b7..5e5073e64e 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -2230,6 +2230,9 @@ findnsec3proofs(dns_validator_t *val) {
 	POST(result);
 
 	if (dns_name_countlabels(zonename) == 0) {
+		if (dns_rdataset_isassociated(&trdataset)) {
+			dns_rdataset_disassociate(&trdataset);
+		}
 		return (ISC_R_SUCCESS);
 	}
 
@@ -2299,6 +2302,9 @@ findnsec3proofs(dns_validator_t *val) {
 			{
 				proofs[DNS_VALIDATOR_NOWILDCARDPROOF] = name;
 			}
+			if (dns_rdataset_isassociated(&trdataset)) {
+				dns_rdataset_disassociate(&trdataset);
+			}
 			return (result);
 		}
 		if (result != ISC_R_SUCCESS) {
@@ -2352,9 +2358,15 @@ findnsec3proofs(dns_validator_t *val) {
 	{
 		result = checkwildcard(val, dns_rdatatype_nsec3, zonename);
 		if (result != ISC_R_SUCCESS) {
+			if (dns_rdataset_isassociated(&trdataset)) {
+				dns_rdataset_disassociate(&trdataset);
+			}
 			return (result);
 		}
 	}
+	if (dns_rdataset_isassociated(&trdataset)) {
+		dns_rdataset_disassociate(&trdataset);
+	}
 	return (result);
 }