Net Snmp Through 5.9.5.2 Denial Of Service Via Blocking Unauthenticated Smux Read

Back www.vulncheck.com

Net Snmp Through 5.9.5.2 Denial Of Service Via Blocking Unauthenticated Smux Read

www.vulncheck.com • September 12, 2026

Share: View original

Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read

CWE-1088: Synchronous Access of Remote Resource without Timeout

CWE-400: Uncontrolled Resource Consumption

Unauthenticated remote denial of service in Net-SNMP snmpd via blocking pre-authentication SMUX read

agent/mibgroup/smux/smux.c at v5.9.5.2

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Denial of Service Vulnerability in Net-SNMP (CVE-2026-89147) A denial of service vulnerability (CVE-2026-89147) has been identified in Net-SNMP versions up to 5.9.5.2, specifically in the SMUX module. This flaw allows unauthenticated remote clients to connect to the SMUX listener and execute a blocking read without a timeout, causing the SNMP daemon (snmpd) to halt indefinitely. Affected systems include internet-facing infrastructure devices and servers running SNMP, particularly where SMUX is enabled. The vulnerability poses a high operational risk as it can disrupt monitoring and alerting capabilities, potentially enabling lateral movement during broader intrusions. Immediate action is advised, including applying vendor patches and disabling SMUX if not required. The vulnerability was published on 2026-09-11, and organizations are urged to monitor for unusual connections and stalled processes. No proof-of-concept or active exploitation has been reported yet. 1 sources 58

Extracted Entities

Attack Types (1)

Denial of Service

CWE Weaknesses (1)

CWE-400 - Uncontrolled Resource Consumption

Vulnerabilities (1)