https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:34:32.471959+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-39697 CVE-2024-39697 — phonenumber panics on parsing crafted phonenumber inputs 2026-10-03T08:34:32.503469+00:00

Affected: whisperfish rust-phonenumber, whisperfish phonenumber

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.

 https://cve.radiocsirt.org/vuln/ghsa-mjw4-jj88-v687 GHSA-mjw4-jj88-v687 — panic on parsing crafted phonenumber inputs 2026-10-03T08:34:32.503530+00:00

Affected: crates.io: phonenumber

### Impact The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.

In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56.

Since f69abee1/0.3.4/#52.

0.2.x series is not affected.

### Patches Upgrade to 0.3.6 or higher.

### Workarounds n/a

### References Whereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.