Vulnerability RUSTSEC-2023-0082
High Risk
HIGH RISK
CVSS Score: 8.6
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 years ago
September 19, 2023 at 12:00 PM UTC
phonenumber: panic on parsing crafted RF3966 phonenumber inputs
0.1.0+8.7.0 - 0.2.4+8.11.3
0.1.0+8.7.0 - 0.2.4+8.11.3
Summary
phonenumber: panic on parsing crafted RF3966 phonenumber inputs
Details
Impact
The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.
In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=.
Patches
Patches will be published as version 0.3.3+8.13.9 and backported as 0.2.5+8.11.3.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 years ago
panic on parsing crafted phonenumber inputs
0.3.4+8.13.34 - 0.3.5+8.13.36 GHSA-mjw4-jj88-v687
0.3.4+8.13.34 - 0.3.5+8.13.36 GHSA-mjw4-jj88-v687
High Risk
2 years ago
phonenumber: panic on parsing crafted phonenumber inputs
0.3.3+8.13.9 - 0.3.5+8.13.36 RUSTSEC-2024-0369
0.3.3+8.13.9 - 0.3.5+8.13.36 RUSTSEC-2024-0369
High Risk
3 years ago
phonenumber panics on parsing crafted RFC3966 inputs
0.1.0+8.7.0 - 0.2.4+8.11.3 and 0.3.0+8.12.9 - 0.3.2+8.13.9 GHSA-whhr-7f2w-qqj2
0.1.0+8.7.0 - 0.2.4+8.11.3 and 0.3.0+8.12.9 - 0.3.2+8.13.9 GHSA-whhr-7f2w-qqj2
Impacted packages
Timeline
Published
3 years ago
September 19, 2023 at 12:00 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC