Read the docs
TI-2026-60387 Aliases CVE-2026-89147GHSA-hv9m-8m5p-82j6

Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read

Priority HIGH 77CWE-1088Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
net-snmpNet-SNMPup to 5.9.5.2—No fix listedCNA
  • Net-SNMP Vendornet-snmp Affected up to 5.9.5.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89147
  2. 2026-10-03 Alias added: GHSA-hv9m-8m5p-82j6
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 2

  • TI-2025-42133 Net-SNMP snmptrapd crash CVSS 3.1CRITICAL 9.8
  • TI-2018-12840 snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer… CVSS 3.1HIGH 7.5
  • TI-2015-04735 The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove… CVSS 3.1HIGH 7.5
  • TI-2022-22058 handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through… CVSS 3.1MEDIUM 6.5
  • TI-2022-22057 handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3… CVSS 3.1MEDIUM 6.5
  • TI-2007-05612 The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a… CVSS 2.0HIGH 7.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences