CVE-2026-73435: Arista EOS OSPFv2 DoS Vulnerability

CVE-2026-73435 Overview

CVE-2026-73435 affects Arista EOS devices running Open Shortest Path First version 2 (OSPFv2) with authentication configured. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet to trigger adjacency flapping and packet loss. The disruption propagates across the broader OSPF routing domain, degrading network availability. The flaw maps to [CWE-345] (Insufficient Verification of Data Authenticity) and requires adjacent network access rather than remote reachability.

Critical Impact
An adjacent attacker can destabilize OSPFv2 adjacencies and disrupt routing across an OSPF domain without authentication.

Affected Products

Arista EOS with OSPFv2 configured
Arista EOS deployments using OSPFv2 authentication
Arista platforms participating in OSPFv2 broadcast segments

Discovery Timeline

2026-09-16 - CVE-2026-73435 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73435

Vulnerability Analysis

The vulnerability resides in the OSPFv2 packet processing path on Arista EOS. OSPFv2 forms adjacencies between routers on a shared broadcast segment and exchanges link-state information to build the routing table. When authentication is configured, the protocol expects packets to be validated before influencing adjacency state.

In this case, a crafted OSPFv2 packet bypasses the trust checks expected by the adjacency state machine. Processing the malformed packet causes the receiving router to reset or flap its adjacency with legitimate neighbors. Repeated flapping forces link-state advertisement (LSA) re-flooding and shortest-path-first (SPF) recomputation across the domain, producing packet loss and transient blackholes.

Root Cause

The underlying weakness is insufficient verification of data authenticity, classified as [CWE-345]. The OSPFv2 implementation does not adequately validate the origin or integrity of certain packet fields before acting on them, even when authentication is enabled. An attacker on the same Layer 2 broadcast segment can therefore inject packets that influence adjacency state without presenting valid authentication material.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reside on the same broadcast segment as a target OSPFv2 speaker. No user interaction and no authentication are required. The attacker transmits crafted OSPFv2 packets toward routers participating in the segment, causing adjacencies to flap and forwarding to degrade. Because OSPF reconvergence affects the entire area, downstream routers not directly connected to the attacker also experience routing instability.

No public proof-of-concept code is available. Technical specifics are documented in the Arista Security Advisory #0171.

Detection Methods for CVE-2026-73435

Indicators of Compromise

Repeated OSPFv2 adjacency state transitions (Full to Init or Down) on affected interfaces without correlating link events.
Unexpected LSA re-flooding and SPF recomputations logged by EOS routing processes.
Packet loss and transient routing blackholes correlated with OSPF neighbor changes on a broadcast segment.

Detection Strategies

Baseline normal OSPFv2 adjacency stability per interface and alert on flap counts exceeding the baseline.
Enable syslog forwarding for OSPF neighbor state changes and centralize logs for correlation with packet capture data.
Inspect OSPFv2 packet counters on affected interfaces for anomalous rates of Hello or DBD packets sourced from unknown MAC addresses.

Monitoring Recommendations

Forward EOS routing logs and interface telemetry to a centralized analytics platform for correlation across the OSPF domain.
Monitor Layer 2 segments carrying OSPFv2 for unexpected devices or MAC addresses transmitting protocol packets.
Track SPF run frequency and LSA generation rates as leading indicators of adjacency instability.

How to Mitigate CVE-2026-73435

Immediate Actions Required

Review the Arista Security Advisory #0171 to identify affected EOS versions in your environment.
Apply the fixed EOS release provided by Arista to all routers participating in OSPFv2.
Audit Layer 2 broadcast segments carrying OSPFv2 to confirm only authorized devices are attached.

Patch Information

Arista has published remediation guidance in Security Advisory #0171. Consult the advisory for the list of affected EOS trains and the corresponding fixed versions, and schedule upgrades on all routers where OSPFv2 is configured.

Workarounds

Restrict physical and logical access to broadcast segments carrying OSPFv2 so untrusted hosts cannot inject packets.
Where feasible, configure OSPFv2 interfaces as point-to-point to reduce exposure of shared broadcast segments.
Apply control-plane policing and interface ACLs to rate-limit or filter OSPFv2 traffic from unexpected sources, following Arista guidance.

bash

# Configuration example
# Refer to Arista Security Advisory #0171 for the exact fixed EOS version
# and any vendor-recommended interim mitigations before applying changes.