PT-2025-39710 · Unknown · Phonenumber

Shai Shnaider · Published 2025-09-27 · Updated 2025-11-07 · CVE-2025-10954

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/nyaruka/phonenumbers versions prior to 1.2.2

Description The package contains an issue related to improper validation of input syntax within the phonenumbers.Parse() function. Providing specifically crafted input can lead to a panic, resulting in a "slice bounds out of range" runtime error.

Recommendations Update to version 1.2.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-1286

Related Identifiers

CVE-2025-10954

GHSA-FMJH-F678-CV3X

GO-2025-3987

OPENSUSE-SU-2025:15710-1

Affected Products

Phonenumber

References · 83

• 🔥 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070 · Exploit
• https://github.com/nyaruka/phonenumbers/issues/148 · Patch
• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe · Patch
• https://osv.dev/vulnerability/GO-2025-3987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fmjh-f678-cv3x · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10954 · Security Note
• https://github.com/nyaruka/phonenumbers · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://suse.com/security/cve/CVE-2025-11375 · Note
• https://suse.com/security/cve/CVE-2025-54471 · Note