Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input caus…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-10954 · Microsoft / collected KEV context

EUVD-2025-31408

GHSA-fmjh-f678-cv3x

GO-2025-3987

cve-program · CVE-2025-10954

• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070
• https://github.com/nyaruka/phonenumbers/issues/148
• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe

euvd · EUVD-2025-31408

• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070
• https://github.com/nyaruka/phonenumbers/issues/148
• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe

nvd · CVE-2025-10954

• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
• https://github.com/nyaruka/phonenumbers/issues/148
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070

osv · GHSA-fmjh-f678-cv3x

• https://nvd.nist.gov/vuln/detail/CVE-2025-10954
• https://github.com/nyaruka/phonenumbers/issues/148
• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
• https://github.com/nyaruka/phonenumbers
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070

osv · GO-2025-3987

• https://github.com/advisories/GHSA-fmjh-f678-cv3x
• https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
• https://github.com/nyaruka/phonenumbers/issues/148
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070

No related operational record is retained in the current change model.