Skip to main content

Net-SNMP CVE-2026-89147

| EUVDEUVD-2026-76036 HIGH
Synchronous Access of Remote Resource without Timeout (CWE-1088)
2026-09-11 VulnCheck GHSA-hv9m-8m5p-82j6
Denial Of Service Net Snmp
8.7
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify host with TCP/199 open
  2. Delivery
    Establish TCP connection to SMUX listener
  3. Exploit
    Hold connection, send zero bytes
  4. Execution
    smux_accept() blocks indefinitely
  5. Persist
    snmpd main loop freezes
  6. Impact
    All SNMP agent functions suspended

Vulnerability Assessment

Weakness
CWE
CWE-1088
Exploitation Conditions

Exploitation requires that the Net-SNMP snmpd process is running with the SMUX subagent module compiled in and active (this is enabled in many distribution packages by default) and that TCP port 199 is reachable from the attacker's network - either exposed directly or accessible from an adjacent network segment. No authentication, credentials, or special SNMP community knowledge are required; a bare TCP SYN is sufficient to begin the block. The vulnerability does NOT affect deployments where port 199 is firewalled to localhost only, where snmpd is compiled without SMUX support, or where SMUX is disabled in snmpd.conf. The impact is limited to availability (complete snmpd hang); confidentiality and integrity of managed data are not affected.
Impact

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures the low-complexity, no-authentication, high-availability-impact nature of this flaw. A critical moderating factor not reflected in the base vector is whether the SMUX listener is actually network-reachable: by default, many Net-SNMP builds bind smux on all interfaces (0.0.0.0:199), but firewall posture and snmpd.conf AgentX/SMUX configuration determine real exposure. Environments where port 199 is firewalled or snmpd is built/configured without SMUX support are not affected. No KEV listing and no confirmed POC reduce the immediate urgency, though the linked researcher gist strongly implies proof-of-concept code exists. The attack itself is trivially automatable - a single TCP connect with no payload is sufficient - so any externally exposed instance should be treated as high priority. EPSS data is not present in the provided intelligence; given the public gist and straightforward attack primitive, exploitation probability is likely above baseline once awareness grows.
Exploit ScenarioDerived

An attacker with network access to TCP port 199 on a host running snmpd with SMUX enabled opens a raw TCP connection to the SMUX listener and then transmits no data. The smux_accept() call in snmpd blocks indefinitely waiting for the SMUX Open PDU, halting the main event loop. All SNMP polls, traps, and queries from NMS infrastructure then time out and fail until an operator manually kills and restarts the snmpd process. The attack can be repeated immediately after restart.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 11, 2026

Unauthenticated remote denial of service in Net-SNMP through 5.9.5.2 allows any network-reachable attacker to permanently suspend all SNMP processing by connecting to the SMUX listener and withholding data. The root cause is smux_accept() issuing a blocking recv() call with no timeout on every newly accepted SMUX connection, stalling snmpd's single-threaded main loop indefinitely. Because the block is permanent and snmpd performs all SNMP agent work in that same thread, the entire agent - monitoring, traps, polling - ceases until the process is manually restarted. No public exploit identified at time of analysis, though a researcher gist documenting the behavior is publicly linked in the advisory.

Earlier versions of this analysis (1)
v1 Sep 11, 2026 - 11:21 CVSS 7.5

Denial of service in Net-SNMP through 5.9.5.2 allows any unauthenticated remote attacker to permanently freeze the snmpd daemon by connecting to the SMUX listener and sending no data. The smux_accept() function in the SMUX module performs a blocking read with no socket timeout on newly accepted connections; because snmpd operates in a single-threaded event loop, this blocking call suspends all SNMP request processing indefinitely until the daemon is manually restarted. A public PoC is available via GitHub gist, and no vendor-released patch has been identified at time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis; the VulnCheck advisory at https://www.vulncheck.com/advisories/net-snmp-through-5.9.5.2-denial-of-service-via-blocking-unauthenticated-smux-read should be monitored for fix releases. As an immediate compensating control, restrict access to TCP port 199 at the host firewall (e.g., iptables -A INPUT -p tcp --dport 199 ! -s <trusted_subnet> -j DROP) so only authorized SMUX subagent hosts can connect; this is actionable and low-risk for environments that do not use SMUX-based subagents. If SMUX is not required at all, disable it by removing or commenting out the smux module from snmpd configuration and rebuilding or reconfiguring snmpd to exclude the SMUX handler - this eliminates the attack surface entirely. Organizations that require SMUX subagent support should additionally implement connection-rate limiting on port 199 and consider wrapping snmpd in a supervisor that auto-restarts on hang detection, though neither prevents the DoS, only reduces its blast radius.

Affected VersionsENISA

net-snmp 0 ≤5.9.5.2

Affected Packages

euvd net_snmp no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Net-SNMP is the canonical open-source SNMP agent and toolkit used on most Linux and Unix systems (cpe:2.3:a:net-snmp:net-snmp:*). Its SMUX (SNMP Multiplexing Protocol, RFC 1227) subagent interface, implemented in agent/mibgroup/smux/smux.c, allows external sub-processes to register MIB subtrees with snmpd over a TCP connection, typically on port 199. The flaw is classified as CWE-1088 (Synchronous Access of Remote Resource without Proper Timeout): upon accepting an inbound TCP connection, smux_accept() immediately performs a blocking read expecting the SMUX Open PDU, but sets no recv() timeout and does not use non-blocking I/O or select(). Because snmpd is single-threaded, this blocking call halts the main select() loop, preventing all SNMP request processing for the lifetime of the idle connection. An attacker simply holds a TCP connection open without sending bytes.

Know when Net Snmp gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.5 HIGH

Network-reachable with no auth or interaction; complete snmpd hang is high availability impact; no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
Analysis Updated
Sep 11, 2026 - 11:28 vuln.today
v2 - CVSS changed
CVSS changed
Sep 11, 2026 - 11:22 NVD
7.5 (HIGH) 8.7 (HIGH)
CVE Published
Sep 11, 2026 - 10:46 cve.org
HIGH 7.5

DescriptionCVE.org

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

Executive ViewAI

Why It Matters

Net-SNMP versions through 5.9.5.2 are vulnerable to an unauthenticated remote denial-of-service attack allowing any attacker with network access to the SMUX listener to permanently suspend SNMP monitoring until manual service restart. Organizations running affected versions will experience complete loss of SNMP agent functionality-monitoring, traps, and polling-creating operational blindness regarding infrastructure status and security events during outages.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict SMUX listener (TCP 199) access via firewall to authorized management networks only; (2) disable SMUX module in snmpd.conf if not actively used in operations; (3) configure firewall connection timeouts to terminate idle SMUX sessions automatically; (4) deploy network IDS rules to detect and alert on SMUX connection attempts from unauthenticated sources; (5) establish automated health checks for SNMP agent process status with rapid escalation and paging on unavailability.

Threat Intelligence Overview

EPSS Score
0.3%
Top 80% exploitable
Prevalence
High
default SNMP agent on most Linux/Unix distributions
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Net Snmp

View all
CVE-2015-5621 HIGH POC
7.5 Aug 19

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnm
CVE-2025-68615 CRITICAL POC
9.8

Buffer overflow in Net-SNMP's SNMP parsing code can allow remote attackers to corrupt memory, potentially leading to cod
CVE-2018-1000116 CRITICAL POC
9.8 Mar 07

NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command e
CVE-2012-6151 MEDIUM POC
4.3 Dec 13

Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote at
CVE-2018-18066 HIGH POC
7.5 Oct 08

snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an un
CVE-2014-3565 MEDIUM POC
5.0 Oct 07

snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of s
CVE-2022-44793 MEDIUM POC
6.5 Nov 07

handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Excepti
CVE-2022-44792 MEDIUM POC
6.5 Nov 07

handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug
CVE-2018-18065 MEDIUM POC
6.5 Oct 08

_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by

CVE-2020-15862 HIGH
7.8 Aug 20

Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability

CVE-2020-15861 HIGH
7.8 Aug 20

Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. Rated high sev
CVE-2014-2284 MEDIUM
5.0 Mar 24

The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1

Same weakness CWE-1088 – Synchronous Access of Remote Resource without Timeout

View all
CVE-2024-8062 HIGH POC
7.5
CVE-2024-8061 HIGH POC
7.5
CVE-2024-12777 MEDIUM POC
5.9
CVE-2026-81520 HIGH
8.7
CVE-2026-103649 HIGH
7.5
CVE-2020-14483 MEDIUM
4.3
CVE-2025-4656 LOW
3.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-89147 ADVISORY https://vuldb.com/vuln/402400 REF https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb REF https://github.com/net-snmp/net-snmp REF https://github.com/net-snmp/net-snmp/blob/v5.9.5.2/agent/mibgroup/smux/smux.c REF https://www.vulncheck.com/advisories/net-snmp-through-5.9.5.2-denial-of-service-via-blocking-unauthenticated-smux-read

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy