What’s Vulnerable › Vulnerabilities

CVE-2025-10954

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-27 · updated 2026-10-19
• Weakness: CWE-1286

Description

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".

Affected products

• github.com/nyaruka/phonenumbers: before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: github.com/nyaruka/phonenumbers 1.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
• https://github.com/nyaruka/phonenumbers/issues/148
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070

Get alerted when CVE-2025-10954 or the next vulnerability affects your stack