CVE-2026-89147 Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read
Unauthenticated remote attackers can cause a denial of service in Net-SNMP by blocking the SMUX listener, suspending all SNMP processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89147?
CVE-2026-89147 is a high-severity denial of service vulnerability in Net-SNMP, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.
Which versions are affected by CVE-2026-89147?
How do I fix CVE-2026-89147?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89147 exists.
Sources
Also known as AZL-101742, DEBIAN-CVE-2026-89147, ECHO-c070-0905-6b62, GHSA-hv9m-8m5p-82j6, ROOT-OS-ALPINE-323-CVE-2026-89147, UBUNTU-CVE-2026-89147.