CVE-2026-89147: Net-SNMP

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

Affected products

• Net-SNMP Net-SNMP: up to and including 5.9.5.2

Published 2026-09-11. Last modified 2026-09-24.