Arista EOS: crafted traffic over certain link configurations exhausts switch CPU and memory and forces a reboot

CVSS 6.7CVE-2026-121369Firmware, BMC & network fabriccurated

Impact

An attacker connected directly to the switch can push its CPU and memory use up until it stops responding, and in the end the switch may reboot. On a GPU cluster, losing a leaf or spine switch takes the nodes behind it out of the fabric, and a reboot can abort training jobs that span those nodes. The record does not say which link configurations or platforms are affected.

Who can reach it

Someone with direct physical connectivity to the switch (CVSS AV:P). No authentication is needed. Only some link configurations are exposed, and the record does not say which ones.

What to do

See Arista Security Advisory 0225 for the affected platforms, the vulnerable link configurations and the fixed EOS releases. The record names no fixed version or workaround. Upgrading EOS on a fabric switch usually means a maintenance window for the links it carries. Until then, limit physical access to switch ports.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121369 https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.