CVE-2019-20892: Net-SNMP

Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days.

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.

Affected products

• Net-SNMP Net-SNMP: up to and including 5.8
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2020-06-25. Last modified 2026-06-17.