Arista EOS: crafted RPKI-RTR Error Report freezes RPKI sync and BGP origin-validation updates

CVSS 8.3CVE-2026-121291Firmware, BMC & network fabriccurated

Impact

A crafted RPKI-to-Router Error Report can leave EOS stuck, believing a cache reset is in progress. While it is stuck, ROA updates, withdrawal reconciliation and BGP origin-validation updates stop. Route origin validation then runs on stale data, so withdrawn or newly invalid routes may not be handled correctly at the datacenter edge. Only switches with RPKI configured and an established RPKI-RTR session are affected.

Who can reach it

An attacker who can send RPKI-RTR protocol messages to the switch: a malicious or compromised RPKI cache, or someone who can inject into the RTR session. No authentication to the switch is needed. Devices without RPKI configured cannot be reached this way (check with show bgp rpki cache).

What to do

Upgrade EOS to 4.36.3M or later in the 4.36 train, or 4.35.7M or later in the 4.35 train. Releases before 4.35.0F are not affected. The advisory lists no fix yet for 4.37.0F; confirm with Arista TAC. This needs a switch image upgrade and reload, so plan for redundant paths. Arista says no mitigation is available. clear bgp rpki cache <name> or restarting the RPKI agent may recover a stuck state, but does not prevent it from happening again.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121291 https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.