Description
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arista Networks | VeloCloud | 1.0.0.0 – < 5.2.0.0, 5.2.0.0 – < 5.2.7.0, 6.1.0.0 – < 6.1.5.0, 6.4.0.0 – < 6.4.2.0 | 5.2.0.0 |
| Arista Networks | VeloCloud Gateway | 1.0.0.0 – < 5.2.0.0, 5.2.0.0 – < 5.2.7.0, 6.1.0.0 – < 6.1.5.0, 6.4.0.0 – < 6.4.2.0 | 5.2.0.0 |
Advisories 1
- WID-SEC-2026-3287 Arista EOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2026