diff --git a/CHANGES b/CHANGES
index 1b27d586c0..548208b3ef 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,8 @@
 
 6318.	[placeholder]
 
-6317.	[placeholder]
+6317.	[security]	Restore DNS64 state when handling a serve-stale timeout.
+			(CVE-2023-5679) [GL #4334]
 
 6316.	[security]	Specific queries could trigger an assertion check with
 			nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index f793805ae4..0021e57c5f 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -27,6 +27,11 @@ Security Fixes
   assertion failure when :any:`nxdomain-redirect` was enabled. This has
   been fixed. :cve:`2023-5517` :gl:`#4281`
 
+- A bad interaction between DNS64 and serve-stale could cause
+  :iscman:`named` to crash with an assertion failure, when both of these
+  features were enabled. This has been fixed. :cve:`2023-5679`
+  :gl:`#4334`
+
 New Features
 ~~~~~~~~~~~~
 
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 07537a8040..b819dc4fdf 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -6251,6 +6251,13 @@ query_lookup_stale(ns_client_t *client) {
 	query_ctx_t qctx;
 
 	qctx_init(client, NULL, client->query.qtype, &qctx);
+	if (DNS64(client)) {
+		qctx.qtype = qctx.type = dns_rdatatype_a;
+		qctx.dns64 = true;
+	}
+	if (DNS64EXCLUDE(client)) {
+		qctx.dns64_exclude = true;
+	}
 	dns_db_attach(client->view->cachedb, &qctx.db);
 	client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
 	client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;