CVE-2026-73458: Arista EOS BFD DOS Vulnerability

CVE-2026-73458 Overview

CVE-2026-73458 affects Arista EOS deployments running authenticated Bidirectional Forwarding Detection (BFD) sessions. A remote, unauthenticated attacker can send a specially crafted packet that terminates active BFD sessions. Because routing protocols such as OSPF, BGP, and IS-IS rely on BFD for rapid failure detection, session termination triggers route recalculation and can produce unintended network topology changes.

The root cause is classified under [CWE-303]: Incorrect Implementation of Authentication Algorithm. The vulnerability requires no privileges or user interaction and is exploitable over the network.

Critical Impact
Remote attackers can tear down authenticated BFD sessions, causing routing protocol convergence events and network instability across affected Arista EOS platforms.

Affected Products

Arista EOS platforms with authenticated BFD sessions configured
Devices running routing protocols that monitor BFD session state
Network deployments relying on BFD for sub-second failure detection

Discovery Timeline

2026-09-15 - CVE-2026-73458 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73458

Vulnerability Analysis

Bidirectional Forwarding Detection is a lightweight protocol defined in RFC 5880 that provides rapid detection of forwarding path failures between two adjacent systems. Routing protocols register with BFD to receive fast notifications when a neighbor becomes unreachable, enabling sub-second reconvergence.

BFD supports optional authentication, including keyed MD5, meticulous keyed MD5, keyed SHA1, and meticulous keyed SHA1, to prevent unauthorized peers from injecting control packets. On affected Arista EOS versions, the authentication path contains a flaw that allows a crafted packet to be accepted or processed in a way that terminates an established session.

When the session transitions to a Down state, dependent routing adjacencies flap. This forces protocols such as BGP, OSPF, or IS-IS to withdraw routes and recompute paths, producing traffic loss and instability disproportionate to the effort required to send the packet.

Root Cause

The defect maps to [CWE-303], an incorrect implementation of the BFD authentication algorithm. Rather than fully validating cryptographic authentication fields before acting on the packet, the affected code path processes crafted input that should be rejected, permitting an attacker to influence session state.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker who can deliver UDP packets destined for BFD ports (typically 3784 or 4784) to an affected device sends a malformed authenticated BFD control packet. The device processes the packet against an existing authenticated session and transitions that session to Down, causing dependent routing protocols to react.

No public proof-of-concept exploit is currently listed, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog. Refer to Arista Security Advisory #0154 for authoritative technical details.

Detection Methods for CVE-2026-73458

Indicators of Compromise

Unexpected BFD session state transitions to Down without corresponding link or interface events
Routing protocol adjacency flaps (BGP, OSPF, IS-IS) coincident with BFD state changes
Inbound BFD control packets from unexpected source addresses on ports 3784 or 4784
Syslog entries indicating authentication anomalies on BFD sessions

Detection Strategies

Correlate BFD session-down events with routing protocol reconvergence in network telemetry
Enable and centralize BFD and routing protocol syslog messages for anomaly analysis
Baseline normal BFD flap rates per session and alert on deviations
Inspect NetFlow or IPFIX records for unexpected sources sending traffic to BFD UDP ports

Monitoring Recommendations

Forward EOS syslog, SNMP traps, and streaming telemetry to a centralized SIEM for correlation
Monitor BGP and OSPF adjacency state changes alongside BFD session state
Alert on BFD authentication failures logged by EOS
Track control-plane packet rates to BFD ports at network edges

How to Mitigate CVE-2026-73458

Immediate Actions Required

Review Arista Security Advisory #0154 to identify affected EOS versions in the environment
Apply the fixed EOS release or hotfix supplied by Arista as soon as maintenance windows allow
Restrict BFD traffic to trusted peer addresses using control-plane ACLs
Increase monitoring on routing adjacencies that depend on authenticated BFD

Patch Information

Arista has documented affected releases and remediation in Arista Security Advisory #0154. Administrators should consult the advisory for the specific fixed EOS versions and any available hotfixes that address the authentication implementation flaw.

Workarounds

Apply control-plane policing and ACLs to permit BFD packets only from configured neighbor IP addresses
Where operationally acceptable, evaluate temporarily disabling BFD authentication or the BFD session on non-critical adjacencies until patched, weighing the trade-off against other risks
Segment management and routing peering networks to limit exposure of BFD endpoints to untrusted sources
Consult Arista TAC for interim mitigations specific to the deployed platform and EOS train