5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-10954

CVE-2025-10954: github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-10954

CVE-2025-10954:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nyaruka/phonenumbers	go	< 1.2.2	1.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic 'slice bounds out of range' error in the Go phonenumbers package, leading to a denial of service (panic). The root cause lies in the buildNationalNumberForParsing function, which improperly handled phone numbers formatted according to RFC3966 that included a phone-context parameter.

The vulnerable code located the phone-context= substring and calculated a starting index for its value. However, it failed to validate that this index was actually within the bounds of the input string. An attacker could provide a string that ends precisely with phone-context=, causing the program to attempt to read from an index beyond the end of the string, which triggers a runtime panic.

The patch rectifies this by introducing two new functions: extractPhoneContext and isPhoneContextValid. The former safely extracts the parameter's value with explicit boundary checks, and the latter validates the content of the parameter. The buildNationalNumberForParsing function was refactored to use these new, safer functions, thus preventing the out-of-bounds access.

Any runtime profile or stack trace generated during the exploitation of this vulnerability would show a call chain originating from the public phonenumbers.Parse function, proceeding through phonenumbers.parseHelper, and terminating with a panic inside phonenumbers.buildNationalNumberForParsing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.