diff --git a/CHANGES b/CHANGES
index b467f66867b72f76703f72f1cfe2333782ad18b2..6bc51b11857f162dc9d12442ba67b8996e27e5b9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,7 @@ OpenLDAP 2.2.28 Engineering
 	Fixed back-bdb/hdb - check for BDB TXN patch
 	Fixed back-hdb nested modrdn bug (ITS#3857)
 	Fixed back-ldap/meta undefined filter propagation (ITS#3785)
+	Fixed back-ldap memory leak (ITS#3862)
 	Fixed back-meta add w/o parent add (ITS#3804)
 	Fixed back-meta control propagation bug (ITS#3813)
 	Fixed syncrepl SASL bind crash (ITS#3792)
diff --git a/servers/slapd/back-ldap/unbind.c b/servers/slapd/back-ldap/unbind.c
index 86b80be1e3b9bb8c6b30057ef9168e193596874e..0a6a2a4603e49f533bec78247575993439e33334 100644
--- a/servers/slapd/back-ldap/unbind.c
+++ b/servers/slapd/back-ldap/unbind.c
@@ -56,6 +56,13 @@ ldap_back_conn_destroy(
 	lc = avl_delete( &li->conntree, (caddr_t)&lc_curr, ldap_back_conn_cmp );
 	ldap_pvt_thread_mutex_unlock( &li->conn_mutex );
 
+#ifdef ENABLE_REWRITE
+	/*
+	 * Cleanup rewrite session
+	 */
+	rewrite_session_delete( li->rwmap.rwm_rw, conn );
+#endif /* ENABLE_REWRITE */
+
 	if (lc) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_LDAP, DETAIL1, 
@@ -67,13 +74,6 @@ ldap_back_conn_destroy(
 			lc->conn->c_connid, 0, 0 );
 #endif
 
-#ifdef ENABLE_REWRITE
-		/*
-		 * Cleanup rewrite session
-		 */
-		rewrite_session_delete( li->rwmap.rwm_rw, conn );
-#endif /* ENABLE_REWRITE */
-
 		/*
 		 * Needs a test because the handler may be corrupted,
 		 * and calling ldap_unbind on a corrupted header results