CVE-2026-73436: Arista EOS OSPFv2 DoS Vulnerability

CVE-2026-73436 Overview

CVE-2026-73436 affects Arista EOS platforms configured with OSPFv2 and OSPFv2 segment routing. An adjacent OSPF neighbor can send a specially crafted OSPFv2 packet that causes the OSPF process to restart unexpectedly. The flaw is tracked under CWE-125 (Out-of-Bounds Read) and results in a denial-of-service condition against the routing control plane.

Arista published the details in Arista Security Advisory #0171. Exploitation requires network adjacency at the OSPF layer, and no authentication or user interaction is needed to trigger the fault.

Critical Impact
A single malformed OSPFv2 packet from an adjacent neighbor can restart the OSPF process, disrupting routing convergence on affected Arista EOS devices.

Affected Products

Arista EOS platforms running OSPFv2
Arista EOS platforms with OSPFv2 segment routing configured
Specific fixed versions listed in Arista Security Advisory #0171

Discovery Timeline

2026-09-16 - CVE-2026-73436 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73436

Vulnerability Analysis

The vulnerability resides in the OSPFv2 packet parsing logic on Arista EOS devices that have segment routing extensions enabled. OSPFv2 segment routing introduces additional TLV (type-length-value) structures inside opaque LSAs (Link State Advertisements) to advertise Segment Identifiers (SIDs) and related routing information.

When the OSPF process receives a crafted packet containing malformed segment routing data, it performs an out-of-bounds read while parsing the structure. The read operation extends beyond the intended memory boundary, producing an invalid state that causes the OSPF agent to terminate and restart. During the restart window, OSPF adjacencies drop, LSDB (Link-State Database) synchronization pauses, and routing convergence is disrupted for affected neighbors.

The issue is a memory-safety defect classified as [CWE-125], affecting only integrity of routing control-plane availability. Data confidentiality and integrity are not directly impacted.

Root Cause

The root cause is insufficient bounds checking during parsing of OSPFv2 segment routing TLVs inside opaque LSAs. The parser trusts length fields or offsets in attacker-controlled packet data without validating them against the actual buffer boundary. This permits a read past the allocated packet buffer, triggering process termination.

Attack Vector

Exploitation requires the attacker to be an adjacent OSPF neighbor on the same broadcast, point-to-point, or NBMA (Non-Broadcast Multi-Access) segment as the target router. The attacker sends a specially crafted OSPFv2 packet containing malformed segment routing fields to trigger the parsing error. No authentication is required if OSPF cryptographic authentication is not enforced on the interface. Repeated packet delivery can cause sustained OSPF flapping and prolonged routing instability.

No public proof-of-concept exploit is available. Refer to Arista Security Advisory #0171 for exact packet structure and remediation details.

Detection Methods for CVE-2026-73436

Indicators of Compromise

Unexpected OSPF process restarts recorded in EOS agent logs (Ospf agent termination or AgentTerminated events).
Repeated OSPF adjacency state changes (FULL to DOWN to FULL) on interfaces where the topology has not changed.
SNMP or syslog alerts indicating LSDB re-synchronization events without a corresponding operational change.

Detection Strategies

Monitor EOS event logs for Ospf agent crashes and correlate with inbound OSPFv2 packets from specific neighbors.
Enable OSPF debug logging temporarily on suspect interfaces to capture malformed LSAs preceding a restart.
Alert on OSPF neighbor flaps that coincide with segment routing LSA updates from a single peer.

Monitoring Recommendations

Forward EOS syslog and agent telemetry to a centralized logging platform for correlation across the routing fabric.
Track OSPF adjacency uptime and convergence metrics with streaming telemetry (gNMI or eAPI).
Baseline expected segment routing LSA sources so anomalous senders can be identified quickly.

How to Mitigate CVE-2026-73436

Immediate Actions Required

Review the fixed EOS versions listed in Arista Security Advisory #0171 and schedule upgrades on affected devices.
Restrict OSPF adjacencies to trusted interfaces and enforce OSPF cryptographic authentication on all OSPF-enabled links.
Audit which devices have OSPFv2 segment routing configured, since only that combination is exposed.

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0171. Apply the fixed EOS release identified for your hardware platform and train combination. Follow Arista's standard in-service software upgrade (ISSU) or maintenance-window procedure to minimize routing impact.

Workarounds

Disable OSPFv2 segment routing on affected devices if the feature is not required, since the vulnerability only manifests when segment routing is enabled.
Enforce OSPF authentication (ip ospf authentication message-digest) on all OSPF interfaces to reduce the risk of unauthorized adjacency formation.
Apply control-plane access controls or physical-layer segmentation to limit which devices can establish OSPF adjacency with production routers.

bash

# Example EOS configuration enforcing OSPF MD5 authentication on an interface
interface Ethernet1
   ip ospf authentication message-digest
   ip ospf message-digest-key 1 md5 <shared-secret>
!
router ospf 1
   area 0.0.0.0 authentication message-digest