CVE-2026-73438: Arista EOS OSPFv3 DOS Vulnerability

CVE-2026-73438 Overview

CVE-2026-73438 affects Arista EOS platforms running Open Shortest Path First version 3 (OSPFv3). An unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted sequence of packets that causes the Ospf3 agent to restart unexpectedly. The crash drops all OSPFv3 adjacencies on the affected device and can disrupt routing across the wider OSPF domain until the agent recovers. Arista credits Dravanet Inc. for the external report and states it is not aware of malicious exploitation in customer networks. The weakness is classified as [CWE-617] Reachable Assertion.

Critical Impact
An adjacent unauthenticated attacker can repeatedly crash the OSPFv3 routing agent, causing sustained routing disruption on affected Arista EOS devices.

Affected Products

Arista EOS with OSPFv3 configured (see Arista Security Advisory #0172 for the affected release list)
Arista EOS platforms participating in an OSPFv3 broadcast domain
Any Arista device with the Ospf3 agent enabled

Discovery Timeline

2026-09-16 - CVE CVE-2026-73438 published to NVD
2026-09-16 - Last updated in NVD database
Vulnerability reported externally by Dravanet Inc.

Technical Details for CVE-2026-73438

Vulnerability Analysis

The vulnerability sits in the Ospf3 agent that implements OSPFv3 on Arista EOS. Processing a specific sequence of crafted OSPFv3 packets triggers a reachable assertion that terminates the agent process. When the agent restarts, every OSPFv3 adjacency on the device tears down. Neighboring routers detect the loss and reconverge, which can propagate routing instability across the OSPF domain.

The attack targets availability of the routing control plane. Data forwarding and other agents remain intact, but OSPFv3-learned routes disappear until adjacencies rebuild. A persistent attacker can loop the crash, keeping the routing process in a restart cycle and denying OSPFv3 connectivity for extended periods.

Root Cause

The root cause is an unhandled condition in the OSPFv3 packet processing path, corresponding to [CWE-617] Reachable Assertion. Malformed or unexpected protocol input triggers an internal assertion instead of being rejected gracefully, causing the Ospf3 agent to abort.

Attack Vector

Exploitation requires network adjacency to the OSPFv3 broadcast domain, so the attacker must reside on a Layer 2 segment where the affected device forms OSPFv3 adjacencies. No authentication or user interaction is required. The attacker sends a crafted set of OSPFv3 packets toward the target device, which processes them and crashes the agent. Because OSPFv3 typically runs on trusted internal segments, exposure depends on the security posture of connected switches, links, and any device with access to those segments.

No public proof-of-concept code is available. Refer to the Arista Security Advisory #0172 for protocol-level details.

Detection Methods for CVE-2026-73438

Indicators of Compromise

Unexpected restarts of the Ospf3 agent recorded in EOS system logs or show agent logs
Sudden loss of all OSPFv3 adjacencies on a device without a corresponding operator change
Repeated OSPFv3 neighbor state flaps and SPF recomputations across the routing domain
Core files or crash dumps generated by the Ospf3 process

Detection Strategies

Alert on Ospf3 process termination, restart, or agent crash events forwarded from EOS syslog
Correlate simultaneous OSPFv3 neighbor down events across multiple devices sharing a broadcast domain
Baseline normal OSPFv3 packet rates per interface and flag anomalous LSA or Hello bursts from a single neighbor

Monitoring Recommendations

Forward EOS syslog and agent logs to a central log platform and tag Ospf3 restart events for review
Monitor SNMP or streaming telemetry for OSPFv3 neighbor state transitions and adjacency counts
Track control-plane packet counters on interfaces participating in OSPFv3 to detect crafted packet floods

How to Mitigate CVE-2026-73438

Immediate Actions Required

Review Arista Security Advisory #0172 and identify EOS versions running in your environment that are affected
Upgrade affected devices to a fixed EOS release listed in the advisory
Restrict Layer 2 access to OSPFv3-enabled segments so only trusted routers can reach the broadcast domain
Enable and enforce OSPFv3 authentication where supported to reduce exposure from untrusted adjacent hosts

Patch Information

Arista has published fixed EOS releases and, where applicable, hotfixes in Arista Security Advisory #0172. Consult the advisory for the exact fixed-in versions matching your platform and train, then schedule upgrades on affected devices.

Workarounds

Limit OSPFv3 adjacencies to trusted, controlled links and disable OSPFv3 on interfaces that do not require it
Apply control-plane policing to rate-limit OSPFv3 traffic reaching the route processor
Segment management and routing networks to prevent untrusted hosts from joining OSPFv3 broadcast domains

bash

# Configuration example: disable OSPFv3 on interfaces that do not require it
interface Ethernet1
   no ipv6 ospf area

# Restrict OSPFv3 to specific trusted interfaces only
ipv6 router ospf 1
   passive-interface default
   no passive-interface Ethernet2