Riskcovery

CVE-2026-19655

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent

State
Published
Severity
7.1 High
Published
Sep 15, 2026
Updated
Sep 16, 2026
Reserved
Aug 12, 2026

Read the record on cve.org

Description

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NArista
3.16.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HArista

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
EOSArista Networks
  • 4.35.0 through 4.35.5MAffectedfrom 4.35.6MNot affected
  • 4.34.0 through 4.34.7.1MAffectedfrom 4.34.8MNot affected
  • 4.33.0 through 4.33.9MAffectedfrom 4.33.10MNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.