Description
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
Metrics
CVSS 3.1 5.9/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | VeloCloud | >= 1.0.0.0, < 5.2.0.0; >= 5.2.0.0, < 5.2.7.0; >= 6.1.0.0, < 6.1.5.0; >= 6.4.0.0, < 6.4.2.0 |
| Arista Networks | VeloCloud Gateway | >= 1.0.0.0, < 5.2.0.0; >= 5.2.0.0, < 5.2.7.0; >= 6.1.0.0, < 6.1.5.0; >= 6.4.0.0, < 6.4.2.0 |
References
Timeline
- Published
- Sep 16, 2026
- Last modified
- Sep 16, 2026
- NVD status
- Awaiting Analysis