diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index e898942501..5b1adbf6da 100644
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -379,6 +379,10 @@ LDAPRDN_rewrite( LDAPRDN rdn, unsigned flags, void *ctx )
 			ava->la_value = bv;
 			ava->la_flags |= LDAP_AVA_FREE_VALUE;
 		}
+		/* reject empty values */
+		if (!ava->la_value.bv_len) {
+			return LDAP_INVALID_SYNTAX;
+		}
 	}
 	rc = LDAP_SUCCESS;