CVE-2025-10954 github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input
An attacker can cause a denial of service by providing crafted input to the Parse function, triggering a runtime panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10954?
CVE-2025-10954 is a medium-severity denial of service vulnerability in github.com/nyaruka/phonenumbers, published on 27 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".
Weakness: CWE-1286
Which versions are affected by CVE-2025-10954?
3 open source packages ship an affected version, including github.com/nyaruka/phonenumbers. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nyaruka/phonenumbers Go | All versions | 1.2.2 |
github.com/nyaruka/phonenumbers Go | All versions | 1.2.2 |
github.com/nyaruka/phonenumbers Go | All versions | 1.2.2 |
Products include Textit Phonenumbers.
How do I fix CVE-2025-10954?
Upgrade github.com/nyaruka/phonenumbers to 1.2.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-10954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10954 exists.
Sources
Also known as GHSA-fmjh-f678-cv3x, GO-2025-3987, MINI-23mh-x894-wr46, MINI-76qj-4j8r-cxmj, MINI-8p9m-j8jf-3m62, MINI-f88c-7hj2-wvv6 and 4 more.