diff --git a/CHANGES b/CHANGES
index 48551d40ac..6400e6cf0f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3071.	[bug]		has_nsec could be used unintialised in
+			update.c:next_active. [RT #20256]
+
 3067.	[bug]		ixfr-from-differences {master|slave}; failed to
 			select the master/slave zones.  [RT #23580]
 
diff --git a/bin/named/update.c b/bin/named/update.c
index fddebe3598..73e5f2b644 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.109.18.33 2009/07/28 15:57:26 marka Exp $ */
+/* $Id: update.c,v 1.109.18.34 2011/03/11 12:58:38 marka Exp $ */
 
 #include <config.h>
 
@@ -1549,7 +1549,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 {
 	isc_result_t result;
 	dns_dbiterator_t *dbit = NULL;
-	isc_boolean_t has_nsec;
+	isc_boolean_t has_nsec = ISC_FALSE;
 	unsigned int wraps = 0;
 
 	CHECK(dns_db_createiterator(db, ISC_FALSE, &dbit));