On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).
In order to be vulnerable to CVE-2026-73458, the following condition must be met:
BFD sessions configured with authentication are affected by this issue. All supported authentication modes are impacted. The full list of authentication modes is below:
- Password
- Keyed MD5
- Meticulous MD5
- Keyed SHA1
- Meticulous SHA1
To determine whether your sessions are affected, run the following show command. If the authentication mode is set to anything other than None, your configuration is impacted. In the example below, the authentication mode is set to Password, indicating an affected configuration.
switch>show bfd peers detail
VRF name: default
<hr />
Peer Addr 1.0.0.2, Intf Ethernet3/30/3, Type normal, Role active, State Up
VRF default, LAddr 1.0.0.1, LD/RD 2432996710/3471785639
Session state is Up and not using echo function
Hardware Acceleration: Async Off, Echo Off
Last Up 06/04/26 13:55:50.630
Last Down 06/04/26 13:55:49.725
Last Diag: No Diagnostic
Authentication mode: Password
Shared-secret profile: bfdProfile_0
TxInt: 500 ms, RxInt: 500 ms, Multiplier: 20
Received RxInt: 500 ms, Received Multiplier: 20
Rx Count: 2308, Rx Interval (ms) min/max/avg: 81/538/438 last: 188 ms ago
Tx Count: 2206, Tx Interval (ms) min/max/avg: 380/516/458 last: 476 ms ago
Detect Time: 10000 ms
Sched Delay: 1TxInt: 1762, 2TxInt: 443, 3TxInt: 0, GT 3TxInt: 0
Registered protocols: bgp
Uptime: 16:51.08
Last packet: Version: 1 - Diagnostic: 0
State bit: Up - Demand bit: 0
Poll bit: 0 - Final bit: 0
Multiplier: 20 - Length: 38
My Discr.: 3471785639 - Your Discr.: 2432996710
Min tx interval: 500 - Min rx interval: 500
Min Echo interval: 500
If BFD is not configured, there is no exposure to this issue. The below show command command will return empty output:
switch>show running-config section bfd
switch>
If BFD is configured but not operational, there is no exposure to this issue. The below show command will return empty output:
switch>show bfd peers detail
switch>
If BFD is configured, and operational but not in authentication mode, there is no exposure to this issue and the output of below show command will look something like:
switch>show bfd peers detail
VRF name: default
<hr />
Peer Addr 1.0.0.2, Intf Ethernet3/30/3, Type normal, Role active, State Up
VRF default, LAddr 1.0.0.1, LD/RD 2432996710/3471785639
Session state is Up and not using echo function
Hardware Acceleration: Async On, Echo Off
Last Up 06/04/26 14:15:32.259
Last Down 06/04/26 14:14:50.328
Last Diag: No Diagnostic
Authentication mode: None
Shared-secret profile: None
TxInt: 500 ms, RxInt: 500 ms, Multiplier: 20
Received RxInt: 500 ms, Received Multiplier: 20
Rx Count: 34, Rx Interval (ms) min/max/avg: 161/496/408 last: 163 ms ago
Tx Count: 29, Tx Interval (ms) min/max/avg: 375/499/440 last: 720 ms ago
Detect Time: 10000 ms
Sched Delay: 1TxInt: 76, 2TxInt: 0, 3TxInt: 0, GT 3TxInt: 0
Registered protocols: bgp
Uptime: 13.65
Last packet: Version: 1 - Diagnostic: 0
State bit: Up - Demand bit: 0
Poll bit: 0 - Final bit: 0
Multiplier: 20 - Length: 24
My Discr.: 3471785639 - Your Discr.: 2432996710
Min tx interval: 500 - Min rx interval: 500
Min Echo interval: 500
No mitigation is available for this issue.
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73458 has been fixed in the following releases:
- 4.36.2F and later releases in the 4.36.x train
- 4.35.6M and later releases in the 4.35.x train
- 4.34.8M and later releases in the 4.34.x train
- 4.33.9M and later releases in the 4.33.x train