Description
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| net-snmp | net-snmp | < 5.9.2 | 5.9.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | net-snmp | 5.9.3+dfsg-1 | — |
| Debian 13 | net-snmp | 5.9.3+dfsg-1 | — |
| Debian 12 | net-snmp | 5.9.3+dfsg-1 | — |
| Debian 11 | net-snmp | 5.9+dfsg-4+deb11u1 | DSA-5209-1 |
| Debian 10 | net-snmp | 5.7.3+dfsg-5+deb10u3 | DLA-3088-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | net-snmp | 5.9.1+dfsg-1ubuntu2.2 | USN-5543-1 |
| Ubuntu 20.04 LTS | net-snmp | 5.8+dfsg-2ubuntu2.4 | USN-5543-1 |
| Ubuntu 18.04 LTS | net-snmp | 5.7.3+dfsg-1.8ubuntu3.7 | USN-5543-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | net-snmp | 5.7.3+dfsg-1ubuntu4.6+esm1 | USN-5795-2 |
| Ubuntu Pro 14.04 LTS | net-snmp | 5.7.2~dfsg-8.1ubuntu3.3+esm3 | USN-5795-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | net-snmp +6 | 1:5.9.1-13.el9_4.3 | RHSA-2024:7260 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | net-snmp +6 | 1:5.9.1-11.el9_2.2 | RHSA-2024:7875 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | net-snmp +6 | 1:5.9.1-13.el9_4.3 | ALSA-2024:7260 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | net-snmp | 1:5.9.1-13.el9_4.3 | RLSA-2024:7260 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-1 |
| SLES 15 SP3 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-1 |
| SLES 12 SP5 | net-snmp | 5.9.4-14.3.1 | SUSE-RU-2024:0029-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | net-snmp | 5.9.4-14.3.1 | SUSE-RU-2024:0029-1 |
| SLE Micro 5.3 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | net-snmp | 5.9.2-1.1 | openSUSE-SU-2024:12174-1 |
| openSUSE Leap 15.5 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-1 |
| openSUSE Leap 15.4 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-1 |
| openSUSE Leap 15.3 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | net-snmp | 5.9.3-150300.15.3.1 | SUSE-SU-2022:4205-2 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.23 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.22 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.21 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.20 | net-snmp | 5.9.3-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.18 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.17 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.16 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.15 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.14 | net-snmp | 5.9.3-r0 | — |
| Alpine v3.13 | net-snmp | 5.9.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | net-snmp +8 | 1:5.7.2-49.amzn2.1.1 | ALAS2-2023-2366 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | net-snmp +6 | 1:5.9.1-13.0.1.el9_4.3 | ELSA-2024-7260 |
Advisories 15
- ALSA-2024:7260 Moderate: net-snmp security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-5795-2 net-snmp vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-5543-1 net-snmp vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- RHSA-2024:7875 Red Hat Security Advisory: net-snmp security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2024:7260 Red Hat Security Advisory: net-snmp security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- DSA-5209-1 net-snmp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3088-1 net-snmp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:7260 Moderate: net-snmp security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-RU-2024:0029-1 Recommended update for net-snmp SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12174-1 libsnmp40-32bit-5.9.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0604 Net-SNMP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 31, 2025
- SUSE-SU-2022:4205-1 Security update for net-snmp SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2022:4205-2 Security update for net-snmp SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2024-7260 Moderate: net-snmp security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 26, 2024
- ALAS2-2023-2366 Moderate: net-snmp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 4, 2023
References
- https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775
- https://bugzilla.redhat.com/show_bug.cgi?id=2103225
- https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/
- https://security.gentoo.org/glsa/202210-29
- https://www.debian.org/security/2022/dsa-5209
- https://bugzilla.redhat.com/show_bug.cgi?id=2105242