---
id: CVE-2024-39697
aliases:
  - RUSTSEC-2024-0369
  - GHSA-mjw4-jj88-v687
title: 'phonenumber:  panic on parsing crafted phonenumber inputs'
summary: 'phonenumber:  panic on parsing crafted phonenumber inputs'
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'
vendor: phonenumber
product: phonenumber
ecosystem: rust
affected:
  - 'phonenumber >= 0.3.3, < 0.3.6'
patched:
  - phonenumber 0.3.6
published: '2024-07-07'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T15:19:21.218890299Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0369'
references:
  - url: 'https://crates.io/crates/phonenumber'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0369.html'
  - url: 'https://github.com/whisperfish/rust-phonenumber/issues/69'
  - url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39697'
tags:
  - osv
  - rust
epss: 0.00711
epssPercentile: 0.53347
ingestedAt: '2026-10-13T11:45:30.171Z'
---

## Overview

### Impact

The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.

In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56.

Since f69abee1/0.3.4/#52.

0.2.x series is not affected.

### Patches
Patches have been published as version `0.3.6+8.13.36`.

## Affected packages

- `phonenumber >= 0.3.3, < 0.3.6`

## Remediation

Upgrade to a patched release:

- `phonenumber 0.3.6`