CVE-2025-10954
📋 TL;DR
The github.com/nyaruka/phonenumbers package versions before 1.2.2 contain an input validation vulnerability in the phonenumbers.Parse() function. Attackers can trigger a panic (runtime error: slice bounds out of range) by providing specially crafted input, potentially causing denial of service. Applications using this Go library for phone number parsing are affected.
💻 Affected Systems
- github.com/nyaruka/phonenumbers Go library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Application crashes with panic, leading to denial of service and potential service disruption if not properly recovered.
Likely Case
Application crashes when processing malicious input, requiring restart and causing temporary service interruption.
If Mitigated
Application gracefully handles the error or recovers automatically with minimal impact.
🎯 Exploit Status
Exploitation requires sending crafted input to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2
Vendor Advisory: https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
Restart Required: Yes
Instructions:
1. Update go.mod to require github.com/nyaruka/phonenumbers v1.2.2 or later. 2. Run 'go mod tidy'. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input validation wrapper
allWrap phonenumbers.Parse() calls with input validation to reject suspicious inputs before processing.
Panic recovery middleware
allImplement panic recovery in HTTP handlers or application layers to prevent crashes from propagating.
🧯 If You Can't Patch
- Implement strict input validation for phone number fields before passing to phonenumbers.Parse()
- Deploy application behind a WAF with input validation rules
🔍 How to Verify
Check if Vulnerable:
Check go.mod for github.com/nyaruka/phonenumbers version. If version is <1.2.2, you are vulnerable.Check Version:
grep 'github.com/nyaruka/phonenumbers' go.modVerify Fix Applied:
After updating, verify go.mod shows version 1.2.2 or higher and test with known malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Application panic logs containing 'runtime error: slice bounds out of range'
- Sudden application restarts/crashes when processing phone number inputs
Network Indicators:
- Unusual input patterns in phone number fields
- Repeated requests with malformed phone numbers
SIEM Query:
source="application.logs" AND "panic" AND "slice bounds out of range"