diff --git a/CHANGES b/CHANGES
index a9d89f1e8b..ad4bf711b1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2553.	[bug]		Reference leak on DNSSEC validation errors. [RT #19291]
+
 2552.	[bug]		zero-no-soa-ttl-cache was not being honoured.
 			[RT #19340]
 
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 527844c935..17d8f781e2 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.167 2009/01/17 15:12:26 fdupont Exp $ */
+/* $Id: validator.c,v 1.168 2009/02/15 23:37:29 marka Exp $ */
 
 #include <config.h>
 
@@ -2018,6 +2018,7 @@ dlv_validatezonekey(dns_validator_t *val) {
 				break;
 		}
 		if (result != ISC_R_SUCCESS) {
+			dns_rdataset_disassociate(&trdataset);
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "no DNSKEY matching DLV");
 			continue;
@@ -2359,6 +2360,7 @@ validatezonekey(dns_validator_t *val) {
 				break;
 		}
 		if (result != ISC_R_SUCCESS) {
+			dns_rdataset_disassociate(&trdataset);
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "no DNSKEY matching DS");
 			continue;