{"id":"CVE-2023-42444","aliases":["RUSTSEC-2023-0082","GHSA-whhr-7f2w-qqj2"],"title":"phonenumber:  panic on parsing crafted RF3966 phonenumber inputs","summary":"phonenumber:  panic on parsing crafted RF3966 phonenumber inputs","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","vendor":"phonenumber","product":"phonenumber","ecosystem":"rust","affected":["phonenumber >= 0.3.0, < 0.3.3"],"patched":["phonenumber 0.3.3"],"published":"2023-09-19","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:15:51.096651256Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0082","references":[{"url":"https://crates.io/crates/phonenumber"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0082.html"},{"url":"https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6"},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42444"}],"tags":["osv","rust"],"epss":0.00867,"epssPercentile":0.58522,"ingestedAt":"2026-10-13T11:45:30.161Z","slug":"CVE-2023-42444","body":"## Overview\n\n### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.\n\n## Affected packages\n\n- `phonenumber >= 0.3.0, < 0.3.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `phonenumber 0.3.3`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}