resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4 when DNS cookies are enabled allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.