# CVE-2026-89147: Net-SNMP denial of service in SMUX module

Source: https://junglewise.ai/threats/cve-2026-89147-net-snmp-denial-of-service-in-smux-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89147 · Severity: high · CVSS 7.5 · Published 2026-09-11

Net-SNMP is a widely-used daemon that provides SNMP network management services. An unauthenticated remote attacker can crash the SNMP service by connecting to the SMUX port and sending no data, causing the service to hang indefinitely and stop responding to all legitimate monitoring requests. This can blind network administrators to infrastructure problems and service outages.

## Quick answers

**Is CVE-2026-89147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89147 being exploited in the wild.

**How severe is CVE-2026-89147?** High severity, with a CVSS score of 7.5, published 11 September 2026.

**Which products and versions are affected?** Net-SNMP through 5.9.5.2.

**Is there a fix for CVE-2026-89147?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89147 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89147?** Check whether you run Net-SNMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the smux_accept() function in the SMUX module (agent/mibgroup/smux/smux.c) where an unauthenticated blocking read is performed on newly accepted connections without a timeout. The code sets a 5-second receive timeout via setsockopt(SO_RCVTIMEO), but this is installed only after authentication succeeds—far too late to protect the initial read. An attacker simply connects to TCP/199 and sends no data, causing the blocking recvfrom() call to hang indefinitely. Since snmpd is single-threaded and handles this accept in its main select() loop, the entire daemon stalls and fails to process legitimate SNMP requests. The vulnerability affects all Net-SNMP 5.x versions through 5.9.5.2. The SMUX module is compiled in by default on most distributions and listens on 0.0.0.0:199 regardless of configuration.

## Affected products

- Net-SNMP Net-SNMP through 5.9.5.2

## Timeline

- 2026-09-11: disclosed
- other: CVE-2026-89147 assigned

## References

- [https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb](https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb)
- [https://github.com/net-snmp/net-snmp](https://github.com/net-snmp/net-snmp)

## Related threats

- [net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted…](https://junglewise.ai/threats/cve-2025-68615-net-snmp-is-a-snmp-application-library-tools-and-daemon-prior-to)