diff --git a/CHANGES b/CHANGES
index 39689a1200..90dea36dd5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3825.	[bug]		Address sign extension bug in isc_regex_validate.
+			[RT #35758]
+
 3824.	[bug]		A collision between two flag values could cause
 			problems with cache cleaning when SIT was enabled.
 			[RT #35858]
diff --git a/lib/isc/regex.c b/lib/isc/regex.c
index 279bcdc437..17b3afbe08 100644
--- a/lib/isc/regex.c
+++ b/lib/isc/regex.c
@@ -220,7 +220,7 @@ isc_regex_validate(const char *c) {
 				++c;
 				switch (*c) {
 				case '.':	/* collating element */
-					if (range) --range;
+					if (range != 0) --range;
 					++c;
 					state = parse_ce;
 					seen_ce = ISC_FALSE;
@@ -255,11 +255,11 @@ isc_regex_validate(const char *c) {
 			default:
 			inside:
 				seen_char = ISC_TRUE;
-				if (range == 2 && *c < range_start)
+				if (range == 2 && (*c & 0xff) < range_start)
 					FAIL("out of order range");
 				if (range != 0)
 					--range;
-				range_start = *c;
+				range_start = *c & 0xff;
 				++c;
 				break;
 			};