Vulnerability GHSA-whhr-7f2w-qqj2
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 years ago
September 21, 2023 at 05:10 PM UTC
phonenumber panics on parsing crafted RFC3966 inputs
0.1.0+8.7.0 - 0.2.4+8.11.3 and 0.3.0+8.12.9 - 0.3.2+8.13.9
0.1.0+8.7.0 - 0.2.4+8.11.3 and 0.3.0+8.12.9 - 0.3.2+8.13.9
Summary
phonenumber panics on parsing crafted RFC3966 inputs
Details
Impact
The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.
In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=.
Patches
Patches will be published as version 0.3.3+8.13.9 and backported as 0.2.5+8.11.3.
Workarounds
n.a.
References
n.a.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 years ago
panic on parsing crafted phonenumber inputs
0.3.4+8.13.34 - 0.3.5+8.13.36 GHSA-mjw4-jj88-v687
0.3.4+8.13.34 - 0.3.5+8.13.36 GHSA-mjw4-jj88-v687
High Risk
2 years ago
phonenumber: panic on parsing crafted phonenumber inputs
0.3.3+8.13.9 - 0.3.5+8.13.36 RUSTSEC-2024-0369
0.3.3+8.13.9 - 0.3.5+8.13.36 RUSTSEC-2024-0369
High Risk
3 years ago
phonenumber: panic on parsing crafted RF3966 phonenumber inputs
0.1.0+8.7.0 - 0.2.4+8.11.3 RUSTSEC-2023-0082
0.1.0+8.7.0 - 0.2.4+8.11.3 RUSTSEC-2023-0082
Impacted packages
Timeline
Published
3 years ago
September 21, 2023 at 05:10 PM UTC
Last Modified
7 months ago
March 13, 2026 at 10:47 AM UTC