diff --git a/CHANGES b/CHANGES
index af333bb407f25f449ffd2a42d11325081b0c1e19..a3da8e38a8aa746e58981be8d81ff5c37d1124df 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,7 @@ OpenLDAP 2.4.20 Engineering
 	Fixed libldap uninitialized return value (ITS#6355)
 	Fixed slapd debug handling of LDAP_DEBUG_ANY (ITS#6324)
 	Fixed slapd-ldap leak (ITS#6326)
+	Fixed slapd-relay bind segfault (ITS#6337)
 	Fixed slapo-memberof operational attr updates (ITS#6329)
 	Fixed slapo-syncprov deadlock (ITS#6335)
 	Documentation
diff --git a/servers/slapd/back-relay/op.c b/servers/slapd/back-relay/op.c
index 31ec8a897c2e77ee30bcde12ed26a030e2ee5df6..1c7ba71baa35a28432ef0fcab8fb473b9abd4460 100644
--- a/servers/slapd/back-relay/op.c
+++ b/servers/slapd/back-relay/op.c
@@ -93,6 +93,27 @@ relay_back_response_cb( Operation *op, SlapReply *rs )
 	return SLAP_CB_CONTINUE;
 }
 
+/* quick hack for ITS#6337: use malloc'ed callback for bind */
+int
+relay_back_cleanup2_cb( Operation *op, SlapReply *rs )
+{
+	op->o_bd = ((relay_callback *) op->o_callback)->rcb_bd;
+	op->o_tmpfree( op->o_callback, op->o_tmpmemctx );
+	op->o_callback = NULL;
+	return SLAP_CB_CONTINUE;
+}
+
+int
+relay_back_response2_cb( Operation *op, SlapReply *rs )
+{
+	relay_callback	*rcb = (relay_callback *) op->o_callback;
+
+	rcb->rcb_sc.sc_cleanup = relay_back_cleanup2_cb;
+	rcb->rcb_bd = op->o_bd;
+	op->o_bd = op->o_callback->sc_private;
+	return SLAP_CB_CONTINUE;
+}
+
 #define relay_back_add_cb( rcb, op, bd )			\
 	{							\
 		(rcb)->rcb_sc.sc_next = (op)->o_callback;	\
@@ -199,7 +220,15 @@ relay_back_op( Operation *op, SlapReply *rs, int which )
 	} else if ( (func = (&bd->be_bind)[which]) != 0 ) {
 		relay_callback	rcb;
 
-		relay_back_add_cb( &rcb, op, bd );
+		if ( which == op_bind ) {
+			/* quick hack for ITS#6337: use malloc'ed callback for bind */
+			relay_callback *rcbp = op->o_tmpcalloc( sizeof( relay_callback ), 1, op->o_tmpmemctx );
+			relay_back_add_cb( rcbp, op, bd );
+			rcbp->rcb_sc.sc_response = relay_back_response2_cb;
+
+		} else {
+			relay_back_add_cb( &rcb, op, bd );
+		}
 
 		RELAY_WRAP_OP( op, bd, which, {
 			rc = func( op, rs );