CVE-2023-36177 is a critical (9.8) flaw in the JSON-RPC API of Snapcast, the multiroom audio server, that lets remote attackers run code with a crafted request. The Debian security tracker says upstream fixed it in version 0.30.0. Update, and keep the control interface off untrusted networks.
What's affected
The NVD record says Snapcast version 0.27.0 is affected. The Debian security tracker gives a wider picture. It says the flaw was introduced in version 0.16.0 and fixed upstream in version 0.30.0, so more than the single version in the record may be vulnerable. That is a difference between the two sources.
Debian also tracks fixed distribution packages:
- Debian 12 (bookworm): 0.26.0+dfsg1-1+deb12u1, in advisory DSA-5847-1.
- Debian 11 (bullseye): 0.23.0+dfsg1-1+deb11u1, in advisory DLA-4252-1.
- Newer Debian releases carry 0.31.0 or later, which includes the upstream fix.
Debian backports the fix into older version numbers, so a lower version string on a Debian system does not always mean it is vulnerable. Use the advisory and the changelog, not the number alone.
I could not read the researcher's write up that the record cites, since the page returned not found. The details here come from the record and the Debian tracker.
How to check if you're exposed
Find the Snapcast version on every machine that runs the server, and note how it was installed.
On Debian or Ubuntu, list the installed packages and versions:
dpkg -l | grep -i snap
apt policy snapserver
If you installed from a release archive, a container image or your own build, ask the binary for its version:
snapserver --version
Then check where the server is reachable. Snapcast exposes a JSON-RPC control interface, and your server configuration file shows which control ports are enabled. If those ports answer from networks you do not trust, treat the server as exposed.
Remember containers and appliances. Home automation images often bundle Snapcast, and they rarely update on their own.
What to do now
- List every Snapcast server in your estate, including bundled copies in containers and media appliances.
- Update to upstream 0.30.0 or later, or to the fixed package your distribution provides. On Debian, apply the update from DSA-5847-1 or DLA-4252-1.
- Restrict the JSON-RPC control ports with a firewall so only trusted hosts can reach them.
- Do not expose Snapcast's control interface to the internet, for example through port forwarding.
- If you cannot update at once, stop the service on machines that do not need it.
- Restart the service after updating and confirm the running version, since an old process can keep running after a package upgrade.
Why it matters
The weakness is CWE-94, improper control of generation of code, often called code injection. The record says a crafted request to the JSON-RPC API lets a remote attacker run code and read sensitive information. The attack needs no privileges and no user interaction, which is why the score is 9.8.
A control interface is meant to be used by trusted clients. When such an interface is reachable by anyone on the network and has a flaw like this one, it becomes a way in to the whole host. Audio servers feel low risk, but they run on the same machines as other things.
It is not in CISA's Known Exploited Vulnerabilities catalogue, and the sources I read do not claim exploitation in the wild. Debian's LTS advisory for this flaw dates from 2025, a useful reminder that packaged software can trail upstream. Check what your distribution actually ships.
Try it yourself
A critical score does not always mean your system is at risk. This demo shows how to check whether a flaw is reachable in your own setup.
Click through it at your own pace, or open it full screen.
Quick check
Is 0.27.0 the only affected version?
The record names 0.27.0, but the Debian tracker says the flaw was introduced in 0.16.0 and fixed in 0.30.0. Treat anything in that range as at risk unless your distributor says otherwise.
Does a low version number on Debian mean I am vulnerable?
Not necessarily. Debian backports fixes, so use the advisory DSA-5847-1 or DLA-4252-1 and the package changelog.
Sources
Last reviewed: 19 October 2026.
