Improper Input Validation in Nyaruka's PhoneNumber Package

CVE-2025-10954

What is CVE-2025-10954?

The Nyaruka PhoneNumber package, specifically versions prior to 1.2.2, suffers from improper validation of input in the phonenumbers.Parse() function. Attackers can exploit this vulnerability by supplying specially crafted inputs, which can trigger a panic and subsequently cause a runtime error indicating that slice bounds are out of range. This flaw may allow malicious actors to disrupt services by leading to unexpected behavior in applications utilizing this library.

References