CVE-2026-73455: Arista EOS OSPFv3 DoS Vulnerability

CVE-2026-73455 Overview

CVE-2026-73455 is a denial-of-service vulnerability in Arista Extensible Operating System (EOS) affecting devices configured with Open Shortest Path First version 3 (OSPFv3). A specially crafted packet processed by the OSPFv3 agent causes the agent to restart unexpectedly, disrupting routing on the affected device. The flaw is remotely reachable over the network without authentication and requires no user interaction. Arista published details in Arista Security Advisory #0173. The root weakness is classified as [CWE-130] Improper Handling of Length Parameter Inconsistency.

Critical Impact
A single malformed OSPFv3 packet can restart the routing agent, interrupting IPv6 routing convergence and impacting availability on affected Arista EOS devices.

Affected Products

Arista EOS with OSPFv3 configured (see Arista Security Advisory #0173 for exact release trains)
Any Arista platform running an EOS image with the OSPFv3 agent enabled
Deployments where OSPFv3 neighbors traverse untrusted or partially trusted transit

Discovery Timeline

2026-09-16 - CVE-2026-73455 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-73455

Vulnerability Analysis

The defect resides in the OSPFv3 protocol agent within Arista EOS. When the agent parses an incoming OSPFv3 packet, a length parameter inconsistency causes the agent to fault and restart. Because OSPFv3 processing occurs on the control plane, any device with OSPFv3 configured and reachable from an attacker over an IPv6 path is exposed. The impact is scoped to availability: the OSPFv3 agent restarts, which drops adjacencies and forces reconvergence. Repeated delivery of the crafted packet can hold the routing process in a restart loop, extending the outage window. Arista describes the condition and affected releases in Security Advisory #0173.

Root Cause

The underlying weakness is [CWE-130] Improper Handling of Length Parameter Inconsistency. The OSPFv3 packet parser trusts a length field that does not match the actual on-wire data. When the parser reads past valid bounds or fails an internal assertion, the agent process terminates and is restarted by the EOS supervisor.

Attack Vector

Exploitation requires the attacker to deliver a single crafted OSPFv3 packet that the target agent will process. This typically means the attacker must be adjacent on an OSPFv3-enabled segment or otherwise able to reach the router with IPv6 multicast or unicast targeting the OSPFv3 process. No credentials and no user interaction are required. Verified proof-of-concept code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Public exploit prediction data reflects a low near-term probability of observed exploitation, consistent with the specialized packet crafting required.

// No verified public proof-of-concept is available.
// Refer to Arista Security Advisory #0173 for reproduction details
// under vendor NDA where applicable.

Detection Methods for CVE-2026-73455

Indicators of Compromise

Unexpected restarts of the OSPFv3 agent (Ospfv3 process) recorded in EOS /var/log/agents/ logs
OSPFv3 adjacencies flapping (FULL to DOWN transitions) without a corresponding link or configuration change
Elevated volumes of malformed OSPFv3 packets observed on control-plane capture or tcpdump of IPv6 protocol 89 traffic

Detection Strategies

Alert on repeated Ospfv3 agent restarts using EOS event manager or streaming telemetry sent to a SIEM
Correlate OSPFv3 neighbor state changes with control-plane packet captures to identify malformed packets preceding a restart
Baseline OSPFv3 neighbor stability and trigger on statistically anomalous adjacency resets

Monitoring Recommendations

Ingest EOS syslog and agent logs into a centralized log platform and retain long enough to reconstruct multi-restart sequences
Monitor show ipv6 ospfv3 neighbor and interface counters for unexplained resets across the routed fabric
Track control-plane policing counters for OSPFv3 drops, which may indicate crafted traffic volume

How to Mitigate CVE-2026-73455

Immediate Actions Required

Review Arista Security Advisory #0173 and identify EOS images in your fleet that are affected
Upgrade affected devices to a fixed EOS release identified by Arista in the advisory
Restrict OSPFv3 adjacencies to trusted interfaces only and shut down OSPFv3 on interfaces facing untrusted networks

Patch Information

Arista publishes fixed EOS versions and any available hotfix scripts in Security Advisory #0173. Apply the fixed release train that matches your currently deployed EOS branch. Where an immediate upgrade is not feasible, apply the vendor-supplied hotfix if provided in the advisory.

Workarounds

Enable OSPFv3 authentication (IPsec AH/ESP) so untrusted peers cannot inject packets that the OSPFv3 agent will process
Apply control-plane access control lists (ACLs) that permit OSPFv3 traffic (IPv6 protocol 89) only from known neighbor addresses
Use interface-level passive-interface on segments that do not require OSPFv3 adjacencies to reduce exposure

bash

# Example: restrict OSPFv3 to trusted interfaces and enable authentication
router ospfv3
  passive-interface default
  no passive-interface Ethernet1
!
interface Ethernet1
  ospfv3 authentication ipsec spi 256 sha1 <key>
!
ipv6 access-list CPP-OSPFV3
  permit 89 <trusted-neighbor-prefix>/64 any
  deny 89 any any