Design/Logic Flaw

Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service assertion failure and daemon exit via a negative response containing large RRSIG RRsets...

ISC bind named DNS server DoS

Large RRSIG in negative response leads to assert...

bind negative response cache poisoning

By spoofing negative reply it's possible to DoS name resolution while spoofed reply doesn't expire from cash...