CVE-2026-73455 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves a denial of service condition within the Open Shortest Path First version three implementation in Arista EOS operating systems. This flaw specifically targets devices where OSPFv3 is actively configured and operational on affected network interfaces. The core technical issue stems from insufficient input validation or improper handling of specific packet structures received by the routing agent. When a specially crafted packet, designed to exploit this logic error, is processed by the system, it triggers an internal fault that forces the OSPFv3 process to terminate abruptly. This behavior aligns with CWE-20 Improper Input Validation and CWE-400 Resource Exhaustion, as the malformed input causes the application resource management subsystem to fail, resulting in a crash of the routing daemon rather than graceful error handling or packet rejection.
From an operational perspective, the unexpected restart of the OSPFv3 agent has significant implications for network stability and availability. OSPF is a dynamic interior gateway protocol used to exchange routing information within autonomous systems. When the process crashes, all adjacencies formed with neighboring routers are immediately lost. This leads to the withdrawal of routes learned via OSPF from the router's forwarding table, potentially causing traffic blackholes or suboptimal path selection depending on the redundancy mechanisms in place. In a highly meshed network environment, this single point of failure can trigger widespread route flapping as neighbors attempt to re-establish adjacencies and recalculate topology changes. The resulting instability degrades overall network performance and can lead to extended periods of connectivity loss for end users relying on services routed through the affected device.
This type of vulnerability is often categorized under denial-of-service attacks where an unauthenticated attacker, or one with limited access depending on interface configuration, can disrupt critical infrastructure services. In terms of threat modeling, this behavior corresponds to ATT&CK technique T1498 Network Denial of Service, specifically the sub-technique involving resource exhaustion through protocol exploitation. The attack vector typically requires network-level access to inject packets into the OSPFv3 communication stream, which may be possible if the router is exposed to untrusted networks or if an attacker has gained a foothold on a connected segment capable of spoofing OSPF hello or database description packets with malformed fields that trigger the crash condition.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software updates that patch the underlying code defect in the OSPFv3 implementation. Administrators should ensure their Arista EOS versions are updated to include fixes addressing this specific issue. In environments where immediate patching is not feasible, network segmentation and access control lists can be employed to restrict OSPF traffic to trusted sources only, thereby reducing the attack surface. Additionally, enabling routing protocol authentication using strong cryptographic methods such as HMAC-SHA256 can prevent unauthorized devices from injecting malicious packets into the OSPFv3 process. Regular monitoring of system logs for unexpected daemon restarts and implementing redundant routing protocols or backup paths can also help maintain network resilience against such disruptions while remediation efforts are underway.