Arista EOS: NULL pointer dereference in BGP-LS DPS consumer role
Summary
On Arista EOS devices running BGP-LS with the Dynamic Path Selection (DPS) consumer role, an attacker holding an authenticated BGP-LS session can send a crafted message that makes the BGP agent restart unexpectedly. The impact is limited to availability, so routing and traffic on affected WAN paths may be interrupted. An Arista Pathfinder deployment is not required.
Affected
- Arista EOS 1.0.0 to before 4.33.0F
- Arista EOS 4.32.0F to before 4.33.0F
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.36.0F to 4.36.2F
- Only with BGP-LS and the DPS consumer role configured; default configuration is unaffected.
Fixed in
Unknown. Confirm the first fixed build for your release train in the Arista advisory.
Workaround
Unknown. No published workaround was found. Check the advisory for configuration mitigations, such as removing the DPS consumer role or restricting BGP-LS sessions.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof-of-concept code known.
- The CVE was published on 2026-11-10 and NVD analysis is pending.
Our recommendation
- Check whether any Arista device runs BGP-LS and the DPS consumer role (show bgp instance | section Address family Link State).
- If affected, restrict BGP-LS peers to known controllers.
- Apply the fixed EOS release or hotfix from the Arista advisory once the build number is confirmed.
- Patch together with CVE-2026-120979 and CVE-2026-120982.
- Monitor the advisory and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0211 www.arista.com
- CVE Record CVE-2026-120978 www.cve.org
- Strix CVE-2026-120978 www.strix.ai
- ThreatInt CVE-2026-120978 cve.threatint.com
- Arista Vulnerability Management Process www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:46.
Original description (NVD)
On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.