diff --git a/CHANGES b/CHANGES
index 24d0afb4cfc0a16f0b4fda791bba1ba4e5a08691..58559af152b590e4bfebf5d24d8b228eb52174bc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,7 @@ OpenLDAP 2.4 Change Log
 
 OpenLDAP 2.4.12 Engineering
 	Fixed liblutil executables on Windows (ITS#5604)
+	Fixed slapd aci performance (ITS#5636)
 	Fixed slapd custom attribute inheritance (ITS#5642)
 	Fixed slapd firstComponentMatch normalization (ITS#5634)
 	Fixed slapd overlay control registration (ITS#5649)
diff --git a/servers/slapd/aci.c b/servers/slapd/aci.c
index 580590f12218cf2d23ac4ed86f0b1de0e0bc588b..ee3c38f68dbf74d9589c153556cec964a001192c 100644
--- a/servers/slapd/aci.c
+++ b/servers/slapd/aci.c
@@ -345,9 +345,12 @@ aci_list_get_rights(
 			continue;
 		}
 
-		found = 1;
 		*mask |= aci_list_get_attr_rights( &perm, attr, val );
 		*mask |= aci_list_get_attr_rights( &perm, &aci_bv[ ACI_BV_BR_ALL ], NULL );
+
+		if ( *mask != ACL_PRIV_NONE ) { 
+			found = 1;
+		}
 	}
 
 	return found;
@@ -439,7 +442,9 @@ aci_mask(
 				opts,
 				sdn;
 	int			rc;
-		
+
+	ACL_INIT( *grant );
+	ACL_INIT( *deny );
 
 	assert( !BER_BVISNULL( &desc->ad_cname ) );