CVE-2025-10954
BaseFortify
Publication date: 2025-09-27
Last updated on: 2025-10-03
Assigner: Snyk
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| textit | phonenumbers | to 1.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1286 | The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in versions of the package github.com/nyaruka/phonenumbers before 1.2.2. It is due to improper validation of the syntactic correctness of input in the phonenumbers.Parse() function. An attacker can exploit this by providing specially crafted input that causes a runtime error, specifically a "slice bounds out of range" panic.
How can this vulnerability impact me? :
The vulnerability can cause the application using the affected package to crash or panic due to a runtime error when processing crafted input. This can lead to denial of service conditions, impacting the availability of the application.