CVE-2026-73436 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves a critical flaw in the Open Shortest Path First version 2 implementation within Arista EOS when Segment Routing is enabled. This issue stems from improper validation of incoming OSPF packets, specifically those crafted by an adjacent router acting as a neighbor in the OSPF adjacency process. When such a specially constructed packet is received, it triggers an unexpected restart or crash of the OSPF routing daemon on the affected device. The root cause typically lies in memory handling errors, such as buffer overflows or null pointer dereferences, where the software fails to correctly parse specific fields within the OSPF header or its extensions related to segment routing. This lack of robust input validation allows malformed data to corrupt internal state structures, leading to a denial of service condition for the routing protocol itself rather than the entire operating system, although the impact on network stability is severe.
From an operational perspective, this vulnerability poses a significant risk to network availability and integrity. OSPF is responsible for maintaining dynamic routing tables within an autonomous system, ensuring that traffic flows efficiently across interconnected networks. An unexpected restart of the OSPF process causes immediate loss of adjacency with all neighboring routers relying on that instance. This results in temporary blackholing of traffic destined through those neighbors until the protocol reconverges and adjacencies are re-established. In large-scale enterprise or service provider environments, this can lead to prolonged periods of packet loss, increased latency due to suboptimal path selection during convergence, and potential cascading failures if other routing protocols depend on OSPF-derived routes. The presence of segment routing configuration exacerbates the risk because SR introduces additional complexity in packet processing, increasing the attack surface for malformed input handling errors.
This flaw aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation, as the software does not adequately verify or sanitize data received from external sources before processing it. Furthermore, according to MITRE ATT&CK framework techniques, this vulnerability can be exploited via T1498 Network Denial of Service, specifically through resource exhaustion or service disruption methods. An attacker with network access to an adjacent router could deliberately send crafted packets to disrupt routing services, effectively performing a denial-of-service attack without needing to compromise the underlying host operating system directly. The exploit requires Layer 2 connectivity and knowledge of OSPF neighbor relationships, making it feasible for insider threats or compromised devices within the same broadcast domain or routed segment.
Mitigation strategies should prioritize immediate patching by applying vendor-provided software updates that address this specific flaw in Arista EOS. Until patches are applied, network administrators can implement access control lists to restrict OSPF packet processing from untrusted sources or adjacent neighbors not explicitly authorized for routing exchanges. Additionally, enabling logging mechanisms to detect abnormal OSPF state transitions may help identify ongoing exploitation attempts. It is also advisable to review segment routing configurations to ensure that only necessary extensions are enabled and that strict validation policies are enforced at the network perimeter where possible. Regular audits of neighbor relationships and monitoring for unexpected process restarts can further enhance resilience against such vulnerabilities.