CVE-2026-19655: Arista EOS DHCP Relay DoS Vulnerability

CVE-2026-19655 Overview

CVE-2026-19655 affects Arista Extensible Operating System (EOS) platforms running Dynamic Host Configuration Protocol (DHCP) relay or snooping with the information option (Option 82) enabled. An unauthenticated attacker on a client-facing VLAN can send a specially crafted packet that causes the DHCP Relay service to restart. The flaw is categorized as improper input validation [CWE-20] and results in a denial of service condition against DHCP relay functionality. The vulnerability requires adjacent network access but no authentication or user interaction.

Critical Impact
An attacker with access to a client-facing VLAN can repeatedly crash the DHCP Relay service, disrupting IP address assignment for downstream clients across affected VLANs.

Affected Products

Arista EOS platforms with DHCP relay or snooping configured with Option 82
Arista EOS platforms configured as DHCP server with match criteria based on the information option
See Arista Security Advisory #0155 for the full list of affected releases

Discovery Timeline

2026-09-15 - CVE-2026-19655 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19655

Vulnerability Analysis

The vulnerability resides in the DHCP Relay service on Arista EOS. When DHCP relay or snooping is configured with the information option (Option 82), or when the DHCP server uses match criteria based on Option 82, the service fails to correctly validate a specific class of malformed DHCP packets. Processing the malformed packet triggers a fault that restarts the DHCP Relay service.

The issue is classified under [CWE-20] Improper Input Validation. Repeated exploitation causes ongoing service restarts, preventing legitimate DHCP DISCOVER, REQUEST, and RENEW traffic from being relayed to upstream DHCP servers. Clients in the affected broadcast domain lose the ability to obtain or renew IP address leases during exploitation.

Root Cause

The DHCP Relay service does not adequately parse or bound-check fields within DHCP Option 82 sub-options before processing them. A crafted packet containing malformed Option 82 content places the service into an unrecoverable state, forcing a restart by the EOS process supervisor.

Attack Vector

Exploitation requires layer-2 adjacency to a client-facing VLAN where DHCP relay is configured. The attacker sends a specially crafted DHCP packet toward the relay interface. No credentials, prior compromise, or user interaction are required. The impact is limited to availability of the DHCP Relay service; confidentiality and integrity are not affected.

No verified public proof-of-concept code is available. Refer to the Arista Security Advisory #0155 for technical detail on the malformed packet structure.

Detection Methods for CVE-2026-19655

Indicators of Compromise

Unexpected DHCP Relay agent restarts recorded in EOS syslog or show agent logs output
Bursts of DHCP client complaints about failed IP address acquisition on VLANs served by the relay
Unusual DHCP packets with malformed Option 82 sub-options observed in packet captures on client-facing VLANs

Detection Strategies

Enable syslog forwarding from EOS devices to a central log platform and alert on repeated DhcpRelayAgent process restarts
Deploy network intrusion detection signatures that flag DHCP packets containing malformed or oversized Option 82 fields
Correlate DHCP lease exhaustion or renewal failure events with DHCP Relay agent crash timestamps

Monitoring Recommendations

Ingest EOS event and agent logs into a SIEM or data lake for behavioral analysis of DHCP subsystem stability
Monitor SNMP or streaming telemetry for agent restart counters on switches acting as DHCP relays
Baseline normal DHCP transaction rates per VLAN and alert on sudden drops that coincide with relay restarts

How to Mitigate CVE-2026-19655

Immediate Actions Required

Review EOS configurations for ip dhcp relay information option and ip dhcp snooping information option usage and identify exposed switches
Restrict layer-2 access to client-facing VLANs where DHCP relay is enabled, especially in shared or guest network segments
Apply the fixed EOS release identified in Arista Security Advisory #0155 to affected devices

Patch Information

Arista has published fixed release information in Arista Security Advisory #0155. Administrators should upgrade to a remediated EOS version corresponding to their current train.

Workarounds

Disable DHCP relay Option 82 insertion where it is not required by upstream DHCP server policy
Remove Option 82 based match criteria from DHCP server configurations if operationally feasible
Enforce port security and 802.1X on client-facing access ports to reduce the population of untrusted devices able to reach the relay
Use control-plane policing (CoPP) and DHCP rate limiting to reduce the impact of malicious DHCP traffic

bash

# Example: disable DHCP relay information option (Option 82) on an EOS interface
switch(config)# interface Vlan100
switch(config-if-Vl100)# no ip dhcp relay information option
switch(config-if-Vl100)# end
switch# write memory