{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 134 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/23419-security-advisory-0134" } ], "title": "Security Advisory 134", "tracking": { "current_release_date": "2026-07-27T19:24:47Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 134", "initial_release_date": "2026-07-27T19:24:47Z", "revision_history": [ { "date": "2026-07-27T19:24:47Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.27.1", "product": { "name": "EOS version 4.27.1", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.33.6", "product": { "name": "EOS version 4.33.6", "product_id": "CSAFPID-3" } }, { "category": "product_version", "name": "EOS version 4.32.8", "product": { "name": "EOS version 4.32.8", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.35.0", "product": { "name": "EOS version 4.35.0", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 4.34.4", "product": { "name": "EOS version 4.34.4", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.31.10", "product": { "name": "EOS version 4.31.10", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-2379", "id": { "system_name": "Arista Bug ID", "text": "1188976" }, "notes": [ { "category": "description", "text": "On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with existing Security Associations, resulting in sequence number mismatches between tunnel endpoints potentially causing unstable communication.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable to CVE-2026-2379, the IPsec anti-replay detection feature must be disabled. The IPsec anti-replay detection feature is enabled by default when IPsec is enabled in Arista EOS.\n\nThe field “Replay window size” in the output of the command “show ip sec connection detail” can be used to verify whether anti-replay is enabled or disabled. A non-zero replay window size indicates that anti-replay detection is enabled.\n\nswitch#show ip sec connection detail\nTunnel0:\n Source address: 2.0.0.1, Destination address: 2.0.0.2\n State: established\n Uptime: 31 minutes, 49 seconds\n VRF: default\n Inbound SPI: 0xcc09b0d4:\n Request ID: 312, Mode: tunnel, Replay window size: 16384, Seq: 0x0\n Errors:\n Packets outside replay window: 0, Replay: 0, Integrity failed: 0\n Lifetime config:\n Soft byte limit: 3728539143000, Hard byte limit: 6442450944000\n Soft packet limit: 2101671584, Hard packet limit: 4000000000\n Soft time limit: 2657 secs, Hard time limit: 3600 secs\n Lifetime current:\n Current bytes: 461294305\n Current packets: 391481\n SA add time: Mon Jul 8 00:49:52 2024\n SA last use time: Mon Jul 8 01:21:34 2024\n Outbound SPI: 0xc7869a84:\n Request ID: 312, Mode: tunnel, Replay window size: 0, Seq: 0x0\n Errors:\n Packets outside replay window: 0, Replay: 0, Integrity failed: 0\n Lifetime config:\n Soft byte limit: 3616989511500, Hard byte limit: 6442450944000\n Soft packet limit: 2653085513, Hard packet limit: 4000000000\n Soft time limit: 2565 secs, Hard time limit: 3600 secs\n Lifetime current:\n Current bytes: 1421924689\n Current packets: 1207796\n SA add time: Mon Jul 8 00:49:52 2024\n SA last use time: Mon Jul 8 01:21:34 2024\n \nIn the example above, the replay window size is non-zero which indicates that anti-replay detection is enabled.\n\nIf anti-replay detection is enabled, then the vulnerability is not present. The IPsec anti-replay detection feature is disabled with the following configuration:\n\nswitch(config)# ip security\nswitch(config-ipsec)# sa policy sa1\nswitch(config-ipsec-sa1)# no anti-replay detection", "title": "1188976: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-2" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2379" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.31.10", "product_ids": [ "CSAFPID-4" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.32.8", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.6", "product_ids": [ "CSAFPID-3" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.4", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.0", "product_ids": [ "CSAFPID-0" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.27.1", "product_ids": [ "CSAFPID-2" ] }, { "category": "mitigation", "details": "There is no known mitigation for CVE-2026-2379. The recommended resolution is to upgrade to a remediated software version at your earliest convenience." } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-5", "CSAFPID-0", "CSAFPID-4", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-2379" } ] }