Improper Input Validation in Nyaruka's PhoneNumber Package
CVE-2025-10954
6.9MEDIUM
What is CVE-2025-10954?
The Nyaruka PhoneNumber package, specifically versions prior to 1.2.2, suffers from improper validation of input in the phonenumbers.Parse() function. Attackers can exploit this vulnerability by supplying specially crafted inputs, which can trigger a panic and subsequently cause a runtime error indicating that slice bounds are out of range. This flaw may allow malicious actors to disrupt services by leading to unexpected behavior in applications utilizing this library.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
github.com/nyaruka/phonenumbers 0 < 1.2.2
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Shai Shnaider