Arista EOS: crafted packets from a BGP peer restart BGP and drop every session when SR-TE is configured

CVSS 6.0CVE-2026-121286Firmware, BMC & network fabriccurated

Impact

A BGP peer can send crafted packets that make the BGP process restart, which drops every BGP session on the device, not just the attacker's. On a fabric whose underlay or overlay runs on BGP, the switch stops forwarding routed traffic until its sessions re-establish and converge. Only devices running the multi-agent routing model with the BGP Segment Routing Traffic Engineering address family configured are affected. The record does not describe any confidentiality or integrity impact.

Who can reach it

A configured BGP peer of the affected device. The attacker needs an established BGP session, so they must control or compromise a neighbor. Unauthenticated hosts cannot trigger it.

What to do

Check Arista Security Advisory 0213 for the affected and fixed EOS releases and any workaround. Upgrading EOS usually means a planned maintenance window per switch, or a hitless upgrade where the platform supports it. Until patched, limit BGP peering to trusted neighbors and remove the SR-TE address family where it is not needed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121286 https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.