{"id":"CVE-2024-39697","aliases":["EUVD-2024-2383","GHSA-mjw4-jj88-v687","RUSTSEC-2024-0369"],"status":"published","title":"phonenumber panics on parsing crafted phonenumber inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00711,"percentile":0.53824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-248","CWE-284","CWE-392","CWE-617"],"published":"2024-07-07T12:00:00Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"crates.io","package":"phonenumber","fixed_in":["0.3.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.4"},{"fixed":"0.3.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.4"},{"fixed":"0.3.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"phonenumber","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.3"},{"fixed":"0.3.6"}]}]}],"products":[{"vendor":"whisperfish","product":"phonenumber"},{"vendor":"whisperfish","product":"rust-phonenumber"}],"references":[{"url":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/issues/69","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/pull/52","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39697","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0369.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mjw4-jj88-v687"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39697.json","tags":["advisory"]},{"url":"https://github.com/whisperfish/rust-phonenumber","tags":["package"]},{"url":"https://crates.io/crates/phonenumber","tags":["package"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39697","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-39697","title":"phonenumber panics on parsing crafted phonenumber inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","status":"published","published":"2024-07-09T14:16:38.493Z","modified":"2024-08-02T04:26:16.016Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284","CWE-392","CWE-1284","CWE-617"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-2383","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","status":"published","published":"2024-07-09T14:16:38Z","modified":"2024-08-02T04:26:16Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-mjw4-jj88-v687","title":"panic on parsing crafted phonenumber inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.\n\nIn a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56.\n\nSince f69abee1/0.3.4/#52.\n\n0.2.x series is not affected.\n\n### Patches\nUpgrade to 0.3.6 or higher.\n\n### Workarounds\nn/a\n\n### References\nWhereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.\n","status":"published","published":"2024-07-09T14:13:48Z","modified":"2024-11-18T16:26:50Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:38:20.012356Z"}],"nvd":[{"id":"CVE-2024-39697","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","status":"published","published":"2024-07-09T15:15:11.29Z","modified":"2026-06-17T07:42:29.523Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284","CWE-392","CWE-617","CWE-1284"],"updated_at":"2026-11-02T14:10:12.016585Z"}],"osv":[{"id":"CVE-2024-39697","title":"phonenumber panics on parsing crafted phonenumber inputs","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","status":"published","published":"2024-07-09T14:16:38.493Z","modified":"2026-10-28T02:31:13.516319671Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-284","CWE-392","CWE-617"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-mjw4-jj88-v687","title":"panic on parsing crafted phonenumber inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.\n\nIn a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56.\n\nSince f69abee1/0.3.4/#52.\n\n0.2.x series is not affected.\n\n### Patches\nUpgrade to 0.3.6 or higher.\n\n### Workarounds\nn/a\n\n### References\nWhereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.\n","status":"published","published":"2024-07-09T14:13:48Z","modified":"2026-09-10T03:49:18.738608398Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical"}],"cwes":["CWE-1284","CWE-248","CWE-392"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"RUSTSEC-2024-0369","title":"phonenumber:  panic on parsing crafted phonenumber inputs","description":"### Impact\n\nThe phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.\n\nIn a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56.\n\nSince f69abee1/0.3.4/#52.\n\n0.2.x series is not affected.\n\n### Patches\nPatches have been published as version `0.3.6+8.13.36`.","status":"published","published":"2024-07-07T12:00:00Z","modified":"2026-10-13T15:19:21.218890299Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.971022Z"}]}}