{"id":"CVE-2024-39697","aliases":["RUSTSEC-2024-0369","GHSA-mjw4-jj88-v687"],"title":"phonenumber:  panic on parsing crafted phonenumber inputs","summary":"phonenumber:  panic on parsing crafted phonenumber inputs","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","vendor":"phonenumber","product":"phonenumber","ecosystem":"rust","affected":["phonenumber >= 0.3.3, < 0.3.6"],"patched":["phonenumber 0.3.6"],"published":"2024-07-07","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:19:21.218890299Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0369","references":[{"url":"https://crates.io/crates/phonenumber"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0369.html"},{"url":"https://github.com/whisperfish/rust-phonenumber/issues/69"},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39697"}],"tags":["osv","rust"],"epss":0.00711,"epssPercentile":0.53347,"ingestedAt":"2026-10-13T11:45:30.171Z","slug":"CVE-2024-39697","body":"## Overview\n\n### Impact\n\nThe phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.\n\nIn a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56.\n\nSince f69abee1/0.3.4/#52.\n\n0.2.x series is not affected.\n\n### Patches\nPatches have been published as version `0.3.6+8.13.36`.\n\n## Affected packages\n\n- `phonenumber >= 0.3.3, < 0.3.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `phonenumber 0.3.6`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}