{"id":"RUSTSEC-2023-0082","revision":"6b6b9335f0de4b20ac7214edeec60d49","records":[{"revision":"6b6b9335f0de4b20ac7214edeec60d49","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2023-0082","aliases":["CVE-2023-42444","GHSA-whhr-7f2w-qqj2"],"title":"phonenumber:  panic on parsing crafted RF3966 phonenumber inputs","description":"### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.","state":0,"publishedAt":"2023-09-19T12:00:00+00:00","modifiedAt":"2026-10-13T15:15:51.0966513+00:00","affected":[{"ecosystem":"crates.io","name":"phonenumber","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.2.5"},{"kind":"introduced","version":"0.3.0"},{"kind":"fixed","version":"0.3.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/phonenumber","https://rustsec.org/advisories/RUSTSEC-2023-0082.html","https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42444"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0082","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2023-0082","identifiers":["RUSTSEC-2023-0082","CVE-2023-42444","GHSA-whhr-7f2w-qqj2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}