Tunnel-decapsulation flaw in Arista EOS (CVE-2026-7473) — forwarding unexpected packets

1Tunnel handling in Arista EOS

CVE-2026-7473 is an incomplete-comparison vulnerability (CWE-1023 — a comparison missing factors that should be considered) in Arista Extensible Operating System (EOS), the OS that runs Arista network switches.

2What happens on decapsulation

Per public information, the switch's check when decapsulating a tunnel (encapsulated traffic) is insufficient, so it wrongly decapsulates and forwards even "unexpected" tunneled packets whose destination matches the configured decapsulation IP.

3Packets reaching paths they should not

This matters because packets that should be kept outside — or routed only along specific paths — can pass through the switch into the internal network. "Segmentation," which protects a network by dividing it, can be bypassed, letting traffic slip past access controls to reach internal devices. The impact is limited to integrity (wrongful forwarding), but it reaches beyond the switch itself into the network.

4The premise of defending by division is bypassed

Segmentation, defending by dividing the network, works by stopping the packets that should not pass. The flaw here sits on the deciding side.

1. 1A tunnel packet arrivesIts destination matches the configured decapsulation IP address
2. 2It is decapsulated on an inadequate checkEven unexpected tunnel packets are decapsulated
3. 3It is forwarded in errorPackets that should have stayed outside enter the interior
4. 4The division is bypassedAccess control is slipped past and internal devices are reached

Impact is limited to integrity — traffic forwarded in error — but attention is due to it reaching beyond the switch itself into the network. In environments configuring tunnel termination or decapsulation especially, reviewing the configuration and confirming that packets are not passing along unexpected routes are recommended.