diff --git a/CHANGES b/CHANGES
index f096f6bef004bb00950c338ffc286831d9a1a4f3..8420a500f1faa9160719bb0c415834a65570ead5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,7 @@ OpenLDAP 2.4 Change Log
 
 OpenLDAP 2.4.12 Engineering
 	Fixed liblutil executables on Windows (ITS#5604)
+	Fixed slapd firstComponentMatch normalization (ITS#5634)
 	Fixed slapd socket closing on Windows (ITS#5606)
 	Fixed slapd-ldap,slapd-meta invalid filter behavior (ITS#5614)
 	Fixed slapd-meta quarantine behavior (ITS#5592)
diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c
index 36d51ba23cbc6dd1a2db7568dc67ec2967da6389..fd386a74f2e2d2b59df75b07bc113a5566bd6171 100644
--- a/servers/slapd/schema_init.c
+++ b/servers/slapd/schema_init.c
@@ -4536,8 +4536,10 @@ firstComponentNormalize(
 
 	if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
 
-	if( val->bv_val[0] != '(' /*')'*/ &&
-		val->bv_val[0] != '{' /*'}'*/ )
+	if( ! ( val->bv_val[0] == '(' /*')'*/
+			&& val->bv_val[val->bv_len - 1] == /*'('*/ ')' )
+		&& ! ( val->bv_val[0] == '{' /*'}'*/
+			&& val->bv_val[val->bv_len - 1] == /*'('*/ '}' ) )
 	{
 		return LDAP_INVALID_SYNTAX;
 	}
@@ -4552,7 +4554,7 @@ firstComponentNormalize(
 
 	/* grab next word */
 	comp.bv_val = &val->bv_val[len];
-	len = val->bv_len - len;
+	len = val->bv_len - len - STRLENOF(/*"{"*/ "}");
 	for( comp.bv_len = 0;
 		!ASCII_SPACE(comp.bv_val[comp.bv_len]) && comp.bv_len < len;
 		comp.bv_len++ )