BIND 9.18.48 Crash upon Serve Stale Enabling, with general: critical: exiting (due to assertion failure) and Recursion Loop Detected

[Ibrahim Almahfooz]

Hi,

Recently we have enabled stale serve on our recursive BIND 9.18.41
(Extended Support Version), the service crashes after a few minutes,
showing the following lines inside the log files:

*Sample from named.run logs showing the recursion loop:
03-May-2026 07:37:41.553 client: info: client @0x7f32d0d4c498
10.40.153.193#14013 (api.al-array.com): view our-users: recursion loop
detected
03-May-2026 07:37:41.553 client: info: client @0x7f32d0993c98
10.36.16.177#10683 (api.al-array.com): view our-users: recursion loop
detected
03-May-2026 07:37:41.702 client: info: client @0x7f32d0da7098
10.36.24.213#47838 (ninja12002.serv00.net): view our-users: recursion loop
detected
03-May-2026 07:37:41.717 client: info: client @0x7f32d25e4098
10.48.72.221#37292 (hayward.walsivrtgam.net): view our-users: recursion
loop detected

*Sample from default logs showing the assertion failure:
default.1:03-May-2026 07:38:30.213 general: critical:
/opt/isc/isc-bind/root/usr/lib64/libisc-9.18.41.so(isc_assertion_failed+0xe)
[0x7f32d615538e]
default.1:03-May-2026 07:38:30.213 general: critical: exiting (due to
assertion failure)

*Our resolver is receiving around 20k QPS.

*Below is the configuration
## Global Named Configuration
options {
        directory "/var/opt/isc/scls/isc-bind/named/data";
        listen-on { 127.0.0.1; 192.168.20.2; };
        allow-transfer {"none";};
        dnssec-validation auto;
        querylog no;
        recursive-clients 10000;
        dnstap {all;};
        dnstap-output file "named-logs/dnstap.file";
        dnstap-identity "ns02.ourdomain.net";
        deny-answer-addresses { deny-answer-referral-acl; };
};

# For monitoring systems to fetch named statistics
statistics-channels {
  inet 192.168.20.2 port 8080 allow {192.168.10.0/24;};
  inet 127.0.0.1 port 8083 allow { any; };
};

# Logging module
include "/etc/opt/isc/scls/isc-bind/logging.conf";


#### Clients ACLs ####

acl deny-answer-referral-acl {
        127.0.0.1/32;
        192.168.20.2/32;
};

acl our-users-acl {
        127.0.0.1;
        192.168.0.0/16;
};

#### Users ####
view "our-users" {
        match-clients { our-users-acl; };
        allow-query { our-users-acl; };
        recursion yes;
        stale-answer-enable yes;
        stale-cache-enable yes;
        max-stale-ttl 12H;
        stale-answer-ttl 30s;
        stale-refresh-time 30s;
        stale-answer-client-timeout 0;

zone "ourdomain.net" {
        type master;
        file "zones/ourdomain.net";
        zone-statistics yes;
        };

zone "." IN {
        type hint;
        file "named.root";
        };
};

#### END OF NAMED CONFIGURATIONS


Appreciate the support

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20260503/b58a686c/attachment.htm>