diff --git a/CHANGES b/CHANGES
index 3188a6c86f..a02ff61d34 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3881.	[bug]		Address memory leak with UPDATE error handling.
+			[RT #36303]
+
 3880.	[test]		Update ans.pl to work with new TSIG support in
 			Net::DNS; add additional Net::DNS version prerequisite
 			checks. [RT #36327]
diff --git a/bin/named/update.c b/bin/named/update.c
index 021b70562e..66a0fe1660 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -2944,10 +2944,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
 					dns_diff_clear(&ctx.del_diff);
 					dns_diff_clear(&ctx.add_diff);
 				} else {
-					CHECK(do_diff(&ctx.del_diff, db, ver,
-						      &diff));
-					CHECK(do_diff(&ctx.add_diff, db, ver,
-						      &diff));
+					result = do_diff(&ctx.del_diff, db, ver,
+							 &diff);
+					if (result == ISC_R_SUCCESS) {
+						result = do_diff(&ctx.add_diff,
+								 db, ver,
+								 &diff);
+					}
+					if (result != ISC_R_SUCCESS) {
+						dns_diff_clear(&ctx.del_diff);
+						dns_diff_clear(&ctx.add_diff);
+						goto failure;
+					}
 					CHECK(update_one_rr(db, ver, &diff,
 							    DNS_DIFFOP_ADD,
 							    name, ttl, &rdata));