Arista EOS: Denial of service in RPKI cache reset handling via crafted Error Report
Summary
A crafted Error Report sent over an RPKI cache session can leave Arista EOS wrongly believing that a cache reset is in progress. While this state persists, the device cannot publish ROAs, reconcile withdrawals or update BGP origin validation. The impact is on routing integrity, and the attack requires no authentication, but only devices running BGP with an RPKI cache are in scope.
Affected
- EOS 4.37.0F
- EOS 4.36.0F to 4.36.2F
- EOS 4.35.0F to 4.35.6M
- Default configuration: unaffected
- Unconfirmed: a third-party aggregator lists a wider range (including 4.34.0F to 4.34.8M and 4.33.0F to 4.33.10M); verify against Arista advisory 25044
Fixed in
Unknown. Check Arista advisory 25044 for fixed releases.
Workaround
Unknown from the sources reviewed. Evaluate Arista guidance; disabling RPKI origin validation on affected devices is a possible option only if acceptable for your routing policy.
Exploitation
- No in-the-wild exploitation or public proof of concept found at the time of writing.
- Not listed in CISA KEV according to a third-party page (not verified).
Our recommendation
- Inventory EOS devices that run BGP with an RPKI cache.
- Compare their EOS versions with the affected list and check Arista advisory 25044 for fixed releases.
- Patch affected devices or apply Arista's workaround as soon as available.
- Monitor the NVD entry and CISA KEV for updates.
- Priority is high where RPKI origin validation is used (typically upstream or multihomed edges); low for typical SME LAN switches.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0222 (25044) www.arista.com
- CVE Record CVE-2026-121291 www.cve.org
- CVE-2026-121291 mirror (threatint) cve.threatint.com
- Strix CVE-2026-121291 (third-party) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:21.
Original description (NVD)
A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.