---
id: CVE-2023-42444
aliases:
  - RUSTSEC-2023-0082
  - GHSA-whhr-7f2w-qqj2
title: 'phonenumber:  panic on parsing crafted RF3966 phonenumber inputs'
summary: 'phonenumber:  panic on parsing crafted RF3966 phonenumber inputs'
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'
vendor: phonenumber
product: phonenumber
ecosystem: rust
affected:
  - 'phonenumber >= 0.3.0, < 0.3.3'
patched:
  - phonenumber 0.3.3
published: '2023-09-19'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T15:15:51.096651256Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0082'
references:
  - url: 'https://crates.io/crates/phonenumber'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0082.html'
  - url: >-
      https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6
  - url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42444'
tags:
  - osv
  - rust
epss: 0.00867
epssPercentile: 0.58522
ingestedAt: '2026-10-13T11:45:30.161Z'
---

## Overview

### Impact
The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.

In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.

### Patches
Patches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.

## Affected packages

- `phonenumber >= 0.3.0, < 0.3.3`

## Remediation

Upgrade to a patched release:

- `phonenumber 0.3.3`