~ / search / GHSA-fmjh-f678-cv3x

GHSA-fmjh-f678-cv3x

github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-10954

Packages

EcosystemPackageAffectedFixed in
Go github.com/nyaruka/phonenumbers < 1.2.2 1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".

References

External links from the advisory. They lead to third-party sites.