CVE-2026-73438

Executive Summary

CVE-2026-73438 is an unauthenticated denial-of-service vulnerability in the OSPFv3 routing agent on Arista EOS platforms. An attacker who can reach the same OSPFv3 broadcast domain as a target device can send a specially crafted sequence of packets that causes the OSPFv3 (Ospf3) agent process to restart unexpectedly, tearing down all OSPFv3 adjacencies on the affected device and potentially disrupting routing across the wider OSPF domain until reconvergence. The flaw is rated CVSS 5.3 (Medium) with high availability impact but requires adjacency to the Layer 2 broadcast segment and conditions that reduce exploit reliability (AC:H). No public proof-of-concept, exploit code, or in-the-wild exploitation has been observed; EPSS is 0.00214 (11.9th percentile), and the CVE is not listed in CISA KEV.

Technical Analysis

CVE-2026-73438 is a protocol-level denial-of-service condition mapped to CWE-617 (Reachable Assertion). The weakness class indicates that crafted input drives the affected process into an unreachable or invalidity state that the implementation fails to handle gracefully, resulting in a process abort rather than controlled error handling. In practice, this manifests as an unexpected restart of the "Ospf3 agent" — the EOS process responsible for OSPFv3 (OSPF for IPv6) adjacency formation, flooding, and route computation.

Key characteristics derived from the available description:

• Attack surface: OSPFv3 control-plane traffic on a shared broadcast domain. OSPFv3 operates directly over IPv6 using protocol number 89 (as defined by the OSPFv3 protocol); adjacency-forming and flooding packets are processed by the Ospf3 agent before any authentication or adjacency is established for multicast Hello processing. This is consistent with the CVSS vector's PR:N (no privileges required) and AV:A (adjacent network).
• Trigger mechanism: A "specially crafted set of packets" causes the agent to restart. The description does not identify specific packet fields, PDU types, or malformed options, so the precise parsing defect cannot be stated without speculation. The set of packets phrasing implies a sequence or stateful trigger rather than a single malformed packet.
• Impact mechanism: Process restart terminates all OSPFv3 adjacencies on the affected device. Neighbors detect adjacency loss, flush associated routes, and reconverge. During reconvergence, the device's IPv6 routing table may contain stale or missing entries, causing traffic loss or suboptimal forwarding. Because OSPFv3 is a link-state protocol, disruption can propagate beyond the directly targeted device as topology changes flood through the domain.
• Complexity: CVSS AC:H reflects that the attack requires specific timing, sequence, or state conditions to succeed reliably — consistent with a race or multi-packet state manipulation rather than a trivial single-packet crash.

No function names, PDU type names, file paths, or protocol field identifiers are provided in the NVD description or CNA title; this report does not infer them.

Exploitation Scenarios

No public exploit or PoC exists. The attack chain below is inferred strictly from the vulnerability class (reachable assertion / process crash) and the stated attack surface (same OSPFv3 broadcast domain, unauthenticated).

1. Reconnaissance / target identification. The attacker must first obtain Layer 2 adjacency on a segment where a target Arista EOS device runs OSPFv3. This is feasible for a malicious insider, a compromised host on a routed/trunked access VLAN, or an attacker who has already bridged into the routing segment. The attacker identifies candidate devices by passively observing OSPFv3 multicast traffic on the segment (OSPFv3 Hellos are sent to the AllSPFRouters multicast group) — no credentials are needed to observe these packets.

2. Triggering the flaw. Once adjacent, the attacker emits a crafted sequence of OSPFv3 control packets. Per the advisory, a specific "set of packets" drives the Ospf3 agent into a fatal state (a reachable assertion), causing the process to restart. Because the advisory does not disclose PDU-level detail, the exact malformation is not reproducible from public information at this time.

3. Payload / execution method. At the vulnerability-class level, this is a raw Layer 3 / protocol-number 89 transmission of malformed or state-inconsistent OSPFv3 PDUs. No client-side code execution, no shellcode, and no user interaction (UI:N) are involved. The "payload" is protocol traffic, not memory-corruption input aimed at remote code execution.

4. Post-exploitation impact. The immediate effect is loss of all OSPFv3 adjacencies on the affected device and potential routing disruption across the broader OSPF domain until the agent recovers and reconverges. An attacker could repeat the trigger to sustain intermittent outages — a persistent, low-rate denial of service against IPv6 routing control-plane availability. Because the CVE is availability-only (I:N, C:N), there is no direct confidentiality or integrity impact, but repeated routing instability can indirectly degrade or blackhole dependent services.

Preconditions summary: L2 adjacency to the OSPFv3 broadcast domain; OSPFv3 enabled on the target; crafted packet sequence; successful state-timing alignment (AC:H).

Impact Assessment

CVSS 3.1: 5.3 (Medium) — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

• AV:A (Adjacent): The attacker must be on the same broadcast domain — a meaningful barrier that excludes arbitrary internet attackers but is well within reach of a compromised host within the routing segment or an insider.
• AC:H (High): Exploitation is not trivial and requires precise packet sequencing/timing.
• PR:N / UI:N: No authentication or user interaction is needed, raising the practical likelihood once L2 access is obtained.
• S:U (Unchanged): The crash is confined to the affected device's Ospf3 agent; no privilege escalation or scope escape.
• C:N / I:N / A:H (Availability: High): The only impacted pillar is availability, but its impact is High — process restart, adjacency loss, and potential domain-wide routing disruption.

Blast radius: The directly affected device loses all OSPFv3 adjacencies. Because OSPFv3 is a link-state protocol, topology churn and route flapping can propagate to neighboring OSPFv3 routers, transiently impacting IPv6 forwarding across the OSPF domain. Devices that run OSPFv2 only, or that do not run OSPFv3, are out of scope for this specific flaw. Operational impact is highest in IPv6-only or dual-stack routed networks that depend on OSPFv3 for convergence, and lower in environments where OSPFv3 is a secondary protocol.

EPSS 0.00214 (11.9th percentile) and absence of CISA KEV listing suggest low current exploitation likelihood and no observed malicious activity. However, EPSS reflects only observed/forecast exploitation, not the value of the target segment; a routing control-plane DoS on a core segment carries disproportionate operational weight.

Business impact: Potential IPv6 routing outages, service degradation or blackholing during reconvergence, SLA breaches on routed networks, and operational cost of repeated incident response. For service providers and large enterprises with many OSPFv3 neighbors, a single trigger can produce a multi-site event.

Detection Guidance

Because no network IoC, hash, or byte signature is published, the detection strategy below focuses on the observable behavior class: unexpected Ospf3 agent restarts and adjacency loss.

Sigma Rule

title: Arista EOS Ospf3 Agent Unexpected Restart (CVE-2026-73438)
id: 8f6a1c2e-4b7d-4c9a-9e10-2d3f5a6b7c80
status: experimental
description: Detects unexpected restarts of the EOS Ospf3 agent process, consistent with exploitation of CVE-2026-73438.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73438
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  product: arista
  service: eos
detection:
  selection_restart:
    message|contains:
      - 'Ospf3 agent'
      - 'ospf3'
  selection_event:
    message|contains:
      - 'restart'
      - 'restarted'
      - 'process restart'
      - 'agent terminated'
  condition: selection_restart and selection_event
falsepositives:
  - Planned maintenance or manual process restart
  - Software upgrade events
level: high
tags:
  - attack.t1498
  - cve.2026.73438

Note: Field names above reflect generic EOS syslog phrasing ("Ospf3 agent", "restart"). Analysts must map these to their actual EOS logging/Streaming Telemetry schema before deployment, as vendor log field names are not published in the CVE data.

YARA Rule

rule CVE_2026_73438_Arista_EOS_OSPFv3_Agent_Crash
{
    meta:
        description = "Behavioral/telemetry detection for Ospf3 agent restart consistent with CVE-2026-73438. Not a byte-level exploit signature; no public PoC exists."
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73438"
        cve = "CVE-2026-73438"
        date = "2026-01-01"

    strings:
        $a = "Ospf3 agent" ascii nocase
        $b = "ospf3" ascii nocase
        $c1 = "restart" ascii nocase
        $c2 = "restarted" ascii nocase
        $c3 = "agent terminated" ascii nocase
        $c4 = "unexpectedly" ascii nocase

    condition:
        filesize < 5MB and
        ($a or $b) and
        ($c1 or $c2 or $c3 or $c4)
}

YARA is not well-suited to a protocol-state crash; this rule is provided for scanning captured EOS log/telemetry artifacts, not live packets.

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-73438 Possible Arista EOS OSPFv3 Ospf3 Agent Crash Attempt (IPv6 proto 89)"; ip_proto:89; flow:stateless; threshold:type both, track by_src, count 30, seconds 10; classtype:attempted-dos; reference:cve,CVE-2026-73438; metadata:created_at 2026_01_01, affected_product Arista_EOS; sid:202673438; rev:1;)

Rationale: OSPFv3 runs directly over IPv6 using IP protocol number 89. This rule flags high-rate proto-89 traffic from a single source, which is the only generic network-observable signal available absent a published signature. It will produce false positives on legitimate OSPFv3 flooding and must be tuned (e.g., restrict to subrouter/non-RID source addresses or unusual PDU sizes) in production.

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where process.name : "Ospf3" and event.action : "start" ]
  [ any where process.name : "Ospf3" and event.action : "start" ]

EQL equivalent using process lifecycle events on EOS host telemetry: two Ospf3 process start events within five minutes indicates an unexpected restart cycle and should be triaged against planned maintenance.

Splunk SPL Query

index=network sourcetype=arista:eos
| search ("Ospf3 agent" OR ospf3)
| search (restart* OR "agent terminated" OR "unexpectedly")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Tuning note: threshold on count and restrict to core/aggregation routers with active OSPFv3 neighbors to reduce noise from maintenance windows.

Wazuh OSSEC Rule

<group name="arista,eos,ospf,">
  <rule id="10073438" level="12">
    <decoded_as>arista-eos</decoded_as>
    <match>Ospf3 agent</match>
    <regex>restart|restarted|agent terminated|unexpectedly</regex>
    <description>CVE-2026-73438: Arista EOS Ospf3 agent restarted unexpectedly - possible OSPFv3 DoS</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>dos,cve_2026_73438,</group>
  </rule>
</group>

Decoder (arista-eos) must exist in the deployment; adjust the group and decoder to match the local EOS log pipeline.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). No vendor-fixed version, advisory migration, or hotfix is available in the provided intelligence.

1) Immediate mitigations (compensating controls):

• Restrict OSPFv3 to trusted routing segments; eliminate non-routing hosts from OSPFv3 broadcast domains where feasible (dedicated point-to-point links or passive interfaces on access ports).
• Enable OSPFv3 authentication (IPsec AH/ESP for OSPFv3, per RFC 4552) and, where operationally possible, restrict OSPFv3 multicast (AllSPFRouters/AllDRouters) reachability with ACLs to known router neighbors.
• Apply Layer 2 hardening: port security, 802.1X, DHCP snooping / dynamic ARP/ND inspection, and BPDU guard to reduce the ease of gaining adjacency.
• Harden and monitor OSPFv3 protocol timers/flooding: detect and rate-limit anomalous protocol-89 traffic at the segment edge.
• Segment IPv6 routing control planes so that a crash on one device cannot cascade topology churn domain-wide; consider route summarization/areas to bound reconvergence scope.

2) Patch / upgrade steps:

• No patch exists per current data. Track the Arista security advisory portal (https://www.arista.com/en/support/advisories-notices) for a fixed EOS release under advisory ID for CVE-2026-73438.
• Once a fixed EOS version is published, validate in a lab, schedule a maintenance window, and upgrade affected devices with active OSPFv3. Confirm the Ospf3 agent behavior post-upgrade.
• Until then, apply vendor-recommended workarounds if/when Arista publishes them (none are currently listed).

3) Long-term hardening:

• Maintain a continuous inventory of devices running OSPFv3 and track their EOS versions against advisories.
• Adopt a defense-in-depth routing security posture: control-plane policing (CoPP) to protect the Ospf3 agent, authentication everywhere, and least-privilege L2 access.
• Integrate routing-protocol health telemetry (adjacency counters, process restarts) into the SOC as first-class detections.
• Subscribe to Arista PSIRT notifications and align risk-based patching SLAs for network control-plane CVEs.

References

1. NVD — CVE-2026-73438: https://nvd.nist.gov/vuln/detail/CVE-2026-73438
2. Arista Security Advisories & Notices (vendor PSIRT portal — advisory mapping for CVE-2026-73438 pending): https://www.arista.com/en/support/advisories-notices
3. MITRE ATT&CK — T1498 Network Denial of Service: https://attack.mitre.org/techniques/T1498/
4. CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73438 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation note: The advisory states the issue was reported externally by Dravanet Inc. and that Arista is not aware of any malicious exploitation of this vulnerability in customer networks. No public PoC, exploit code, or Nuclei template exists (PoC_STATUS: None). There is no evidence of in-the-wild exploitation, no CISA KEV listing, and EPSS remains low (0.00214). This report should be used to prioritize defensive controls on OSPFv3-enabled segments rather than as an active-threat warning.