diff --git a/CHANGES b/CHANGES
index 29e2029f01..e08ba33579 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5614.	[bug]		Ensure all resources are properly cleaned up when a call
+			to gss_accept_sec_context() fails. [GL #2620]
+
 5613.	[bug]		It was possible to write an invalid transaction header
 			in the journal file for a managed-keys database after
 			upgrading. This has been fixed. Invalid headers in
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index ee512041fe..6132d863e6 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -739,6 +739,9 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	default:
 		gss_log(3, "failed gss_accept_sec_context: %s",
 			gss_error_tostring(gret, minor, buf, sizeof(buf)));
+		if (gouttoken.length > 0U) {
+			(void)gss_release_buffer(&minor, &gouttoken);
+		}
 		return (result);
 	}