Executive brief
Net-SNMP is a widely-used daemon that provides SNMP network management services. An unauthenticated remote attacker can crash the SNMP service by connecting to the SMUX port and sending no data, causing the service to hang indefinitely and stop responding to all legitimate monitoring requests. This can blind network administrators to infrastructure problems and service outages.
Technical details
The vulnerability exists in the smux_accept() function in the SMUX module (agent/mibgroup/smux/smux.c) where an unauthenticated blocking read is performed on newly accepted connections without a timeout. The code sets a 5-second receive timeout via setsockopt(SO_RCVTIMEO), but this is installed only after authentication succeeds—far too late to protect the initial read. An attacker simply connects to TCP/199 and sends no data, causing the blocking recvfrom() call to hang indefinitely. Since snmpd is single-threaded and handles this accept in its main select() loop, the entire daemon stalls and fails to process legitimate SNMP requests. The vulnerability affects all Net-SNMP 5.x versions through 5.9.5.2. The SMUX module is compiled in by default on most distributions and listens on 0.0.0.0:199 regardless of configuration.
Affected products
- Net-SNMP Net-SNMP through 5.9.5.2
Timeline
- 2026-09-11: disclosed
- other: CVE-2026-89147 assigned