---
id: "CVE-2026-121292"
page: "https://infrastack.ai/live/CVE-2026-121292"
kind: "vulnerability"
aliases: ["CVE-2026-121292"]
title: "Arista EOS: malformed RPKI Error Report reads past packet bounds, can restart the RPKI agent"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EOS", "fixed": ["4.36.3M", "4.35.7M", "4.34.9M", "4.33.11M"], "affected": "4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.24.0F to 4.32.x (End of Support)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arista", "bgp", "eos", "infrastructure", "network-devices", "rpki"]
not_affected_if: ["no-rpki-cache-configured"]
published_at: "2026-11-10T20:18:54+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:56:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121292", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222", "first_seen_at": "2026-11-10T20:56:38+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"]}]
exploit_sources: []
---

# Arista EOS: malformed RPKI Error Report reads past packet bounds, can restart the RPKI agent

Link for people: https://infrastack.ai/live/CVE-2026-121292 (this .md is for agents)

Arista Security Advisory 0222 (Nov 10, 2026): a malformed RPKI-to-Router Error Report from the RPKI cache makes EOS read past packet bounds. It can terminate or restart the RPKI agent, or expose memory contents through logging. Found internally by Arista, which knows of no exploitation. Arista states no mitigation and no hotfix exist; upgrade.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected 4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.24.0F to 4.32.x (End of Support) fixed 4.36.3M, 4.35.7M, 4.34.9M, 4.33.11M

## How to check

Run 'show bgp rpki cache' on the switch; if no RPKI cache is configured under 'router bgp' (rpki cache <name> / host <addr>) and no RPKI-RTR session is established, the issue cannot be reached. Then check 'show version' against the affected ranges. Indicator: grep 'Received malformed Error Report PDU from cache server' /var/log/eos.

## Fix

Upgrade EOS to 4.36.3M or later (4.36.x), 4.35.7M or later (4.35.x), 4.34.9M or later (4.34.x), or 4.33.11M or later (4.33.x). Arista lists no fixed release for 4.37.0F and for the End of Support trains from 4.24.0F; move to a supported fixed train. No hotfix.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121292
- 2026-11-10T20:56:38+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222 — Read Arista SA 0222 (primary). Affected versions, RPKI-cache precondition and fixes verified from vendor page. No PoC or exploitation known. Sibling CVE-2026-121291 is in the same advisory. 4.37.x fix not stated.

## Documents

- [advisory] Arista Security Advisory 0222 https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222

## From the sources

A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_