Race condition in Arista Extensible Operating System (EOS) - CVE-2019-14810
Published: May 17, 2025
Vulnerability identifier: #VU109285
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14810
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a race condition in the implementation of the Label Distribution Protocol (LDP) protocol. The LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding.
Affected software
Arista Extensible Operating System (EOS)
How to mitigate CVE-2019-14810
Install updates from vendor's website.
Arista Extensible Operating System (EOS) - addressed in versions 4.20.14M, 4.21.2.4F, 4.22.0.2F, 4.23.0F