CVE-2025-10954: github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

The vulnerability is a classic 'slice bounds out of range' error in the Go phonenumbers package, leading to a denial of service (panic). The root cause lies in the buildNationalNumberForParsing function, which improperly handled phone numbers formatted according to RFC3966 that included a phone-context parameter.

The vulnerable code located the phone-context= substring and calculated a starting index for its value. However, it failed to validate that this index was actually within the bounds of the input string. An attacker could provide a string that ends precisely with phone-context=, causing the program to attempt to read from an index beyond the end of the string, which triggers a runtime panic.

The patch rectifies this by introducing two new functions: extractPhoneContext and isPhoneContextValid. The former safely extracts the parameter's value with explicit boundary checks, and the latter validates the content of the parameter. The buildNationalNumberForParsing function was refactored to use these new, safer functions, thus preventing the out-of-bounds access.

Any runtime profile or stack trace generated during the exploitation of this vulnerability would show a call chain originating from the public phonenumbers.Parse function, proceeding through phonenumbers.parseHelper, and terminating with a panic inside phonenumbers.buildNationalNumberForParsing.