CVE-2025-10954CWE-1286

CVE-2025-10954

Medium · published September 27, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2025-09-27T09:15Z
Affected products (1)
ProductVersionsFixed in
textit/phonenumbers< 1.2.21.2.2
References (3)
https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe · [email protected]https://github.com/nyaruka/phonenumbers/issues/148 · [email protected]https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070 · [email protected]
EPSS history
Timeline
  • 27 SEP 05:00Z
    Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the…
    cvelistv5