{"id":"RUSTSEC-2024-0369","revision":"209ae5bc8d7a49c2961c4662d3c93b4f","records":[{"revision":"209ae5bc8d7a49c2961c4662d3c93b4f","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0369","aliases":["CVE-2024-39697","GHSA-mjw4-jj88-v687"],"title":"phonenumber:  panic on parsing crafted phonenumber inputs","description":"### Impact\n\nThe phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.\n\nIn a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56.\n\nSince f69abee1/0.3.4/#52.\n\n0.2.x series is not affected.\n\n### Patches\nPatches have been published as version `0.3.6+8.13.36`.","state":0,"publishedAt":"2024-07-07T12:00:00+00:00","modifiedAt":"2026-10-13T15:19:21.2188903+00:00","affected":[{"ecosystem":"crates.io","name":"phonenumber","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.3"},{"kind":"fixed","version":"0.3.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/phonenumber","https://rustsec.org/advisories/RUSTSEC-2024-0369.html","https://github.com/whisperfish/rust-phonenumber/issues/69","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39697"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0369","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0369","identifiers":["RUSTSEC-2024-0369","CVE-2024-39697","GHSA-mjw4-jj88-v687"]},"retained":false,"historicalAffected":[]}],"coverage":[]}