The flaw is in the SMUX module of Net‑SNMP, where the function smux_accept performs an unauthenticated blocking read on newly accepted connections without a timeout. An attacker can open a connection to the SMUX listener and send no data, causing the single‑threaded snmpd main loop to block indefinitely and suspend all SNMP processing. This results in a denial of service on the agent without the need to supply valid credentials. The vulnerability demonstrates CWE‑1088, uncontrolled resource consumption, and CWE‑400, improper input validation, as the service accepts data without enforcing limits or validating input.

The vulnerability affects Net‑SNMP, version 5.9.5.2 and earlier. All deployments of this agent that expose the SMUX listener are at risk. The issue is specific to the Net‑SNMP product and does not apply to other SNMP implementations.

With a CVSS score of 8.7 the flaw is considered high severity, and the EPSS score is not available. Attackers can trigger the denial of service remotely and without authentication by simply establishing a TCP connection to the SMUX port, which is the primary attack vector. Operability of the SNMP agent is fully disrupted until the process monitoring infrastructure to outage. The weakness is an example of CWE‑1088, uncontrolled resource consumption, and CWE‑400, improper input validation, because the service accepts data without enforcing limits or validating input.