CVE-2026-89147
Fixed in a distro release EPSS <1%CVSS 7.5
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.
Products: net-snmp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | net-snmp | no fix |
| Chainguard | net-snmp-agent-libs | no fix |
| Chainguard | net-snmp-dev | no fix |
| Chainguard | net-snmp-doc | no fix |
| Chainguard | net-snmp-gui | no fix |
| Chainguard | net-snmp-libs | no fix |
| Chainguard | net-snmp-perl | no fix |
| Chainguard | net-snmp-tools | no fix |
| Debian 12 | net-snmp | no fix |
| Debian 13 | net-snmp | no fix |
| Debian 14 | net-snmp | 5.9.5.2+dfsg-3 |
| Ubuntu 22.04 LTS | net-snmp | no fix |
| Ubuntu 24.04 LTS | net-snmp | no fix |
| Ubuntu 26.04 LTS | net-snmp | no fix |
| Ubuntu Pro 14.04 LTS | net-snmp | no fix |
| Ubuntu Pro 16.04 LTS | net-snmp | no fix |
| Ubuntu Pro 18.04 LTS | net-snmp | no fix |
| Ubuntu Pro 20.04 LTS | net-snmp | no fix |
| Wolfi | net-snmp | no fix |
| Wolfi | net-snmp-agent-libs | no fix |
| Wolfi | net-snmp-dev | no fix |
| Wolfi | net-snmp-doc | no fix |
| Wolfi | net-snmp-gui | no fix |
| Wolfi | net-snmp-libs | no fix |
| Wolfi | net-snmp-perl | no fix |
| Wolfi | net-snmp-tools | no fix |