Log in Start free

Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck

CVE-2026-89147Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Net-SNMP from net-snmp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12net-snmpno fix listedDEBIAN-CVE-2026-89147
Debian:13net-snmpno fix listedDEBIAN-CVE-2026-89147
Debian:14net-snmp5.9.5.2+dfsg-3DEBIAN-CVE-2026-89147
Ubuntu:22.04:LTSnet-snmp5.9.1+dfsg-1ubuntu2.10UBUNTU-CVE-2026-89147
Ubuntu:22.04:LTSnet-snmp5.9.1+dfsg-1ubuntu2.10USN-8997-1
Ubuntu:24.04:LTSnet-snmp5.9.4+dfsg-1.1ubuntu3.3USN-8997-1
Ubuntu:24.04:LTSnet-snmp5.9.4+dfsg-1.1ubuntu3.3UBUNTU-CVE-2026-89147
Ubuntu:26.04:LTSnet-snmp5.9.4+dfsg-2ubuntu3.1USN-8997-1
Ubuntu:26.04:LTSnet-snmp5.9.4+dfsg-2ubuntu3.1UBUNTU-CVE-2026-89147

Affected products (as reported)

VendorProductVersions
net-snmp Net-SNMP 0 – through 5.9.5.2

Weakness: CWE-1088, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References