CVE-2025-8872: A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

Published Dec 16, 2025

Updated

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch. This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see: EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-8872 has been fixed in the following releases: * 4.34.2F and later releases in the 4.34.x train * 4.33.5M and later releases in the 4.33.x train * 4.32.8M and later releases in the 4.32.x train * 4.31.9M and later releases in the 4.31.x train

Event History

Dec 16, 2025

CVE Published

via MITRE·07:32 PM

Data Sourced

via MITRE·07:32 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

May 10, 57945

Event

via FIRST·07:28 AM

Frequently Asked Questions

What is the severity of CVE-2025-8872?

CVE-2025-8872 is classified as a high severity vulnerability due to its potential to disrupt OSPFv3 routes.

How do I fix CVE-2025-8872?

To mitigate CVE-2025-8872, it is recommended to update the Arista EOS to the latest version provided by the vendor.

What effect does CVE-2025-8872 have on OSPFv3 configurations?

CVE-2025-8872 can cause high CPU utilization, leading to potential restarts of the OSPFv3 process and route disruption.

Which platforms are affected by CVE-2025-8872?

CVE-2025-8872 affects platforms running Arista EOS with OSPFv3 configured.

Is there a workaround for CVE-2025-8872?

Currently, the primary recommendation is to apply updates, as no specific workaround is detailed for CVE-2025-8872.