Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
CVE-2026-7473
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-7473
EOS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Arista Networks",
"product": "EOS",
"versions": [
{
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.35.0",
"versionType": "custom",
"lessThanOrEqual": "4.35"
},
{
"status": "affected",
"version": "4.34.0",
"versionType": "custom",
"lessThanOrEqual": "4.34"
},
{
"status": "affected",
"version": "4.33.0",
"versionType": "custom",
"lessThanOrEqual": "4.33"
},
{
"status": "affected",
"version": "4.32.0",
"versionType": "custom",
"lessThanOrEqual": "4.32"
},
{
"status": "affected",
"version": "4.31.0",
"versionType": "custom",
"lessThanOrEqual": "4.31"
},
{
"status": "affected",
"version": "*",
"versionType": "custom",
"lessThanOrEqual": "4.30"
}
],
"platforms": [
"7020R Series",
"7280R/R2 Series",
"7500R/R2 Series",
"7280R3 Series (Limited exposure: IP-in-IPv6 and GUEv6)",
"7500R3 Series (Limited exposure: IP-in-IPv6 and GUEv6)",
"7800R3 Series (Limited exposure: IP-in-IPv6 and GUEv6)"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-7473
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12154 · Revision 1
- Added to Heist Feed
- Publisher date