{"id":"CVE-2023-42444","aliases":["EUVD-2023-2608","GHSA-whhr-7f2w-qqj2","RUSTSEC-2023-0082"],"status":"published","title":"phonenumber panics on parsing crafted RF3966 inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00867,"percentile":0.58974,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-248","CWE-392"],"published":"2023-09-19T12:00:00Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"crates.io","package":"phonenumber","fixed_in":["0.2.5","0.3.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.5"},{"introduced":"0.3.0"},{"fixed":"0.3.3"}]}]}],"products":[{"vendor":"whisperfish","product":"phonenumber"},{"vendor":"whisperfish","product":"rust-phonenumber"}],"references":[{"url":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42444","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0082.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-whhr-7f2w-qqj2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42444.json","tags":["advisory"]},{"url":"https://github.com/whisperfish/rust-phonenumber","tags":["package"]},{"url":"https://crates.io/crates/phonenumber","tags":["package"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42444","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-42444","title":"phonenumber panics on parsing crafted RF3966 inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","status":"published","published":"2023-09-19T14:47:22.026Z","modified":"2024-09-24T20:46:54.422Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-2608","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","status":"published","published":"2023-09-19T14:47:22Z","modified":"2024-09-24T20:46:54Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:12.924195Z"}],"ghsa":[{"id":"GHSA-whhr-7f2w-qqj2","title":"phonenumber panics on parsing crafted RFC3966 inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.\n\n### Workarounds\nn.a.\n\n### References\nn.a.","status":"published","published":"2023-09-21T17:10:57Z","modified":"2026-03-11T20:35:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:39:34.616253Z"}],"nvd":[{"id":"CVE-2023-42444","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","status":"published","published":"2023-09-19T15:15:56.66Z","modified":"2026-06-17T06:23:50.55Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-42444","title":"phonenumber panics on parsing crafted RF3966 inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","status":"published","published":"2023-09-19T14:47:22.026Z","modified":"2026-10-28T02:30:48.132670647Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-248","CWE-392"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-whhr-7f2w-qqj2","title":"phonenumber panics on parsing crafted RFC3966 inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.\n\n### Workarounds\nn.a.\n\n### References\nn.a.","status":"published","published":"2023-09-21T17:10:57Z","modified":"2026-03-13T10:47:43.430911Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-248","CWE-392"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"RUSTSEC-2023-0082","title":"phonenumber:  panic on parsing crafted RF3966 phonenumber inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.","status":"published","published":"2023-09-19T12:00:00Z","modified":"2026-10-13T15:15:51.096651256Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.971022Z"}]}}