CVE-2024-39697 json
phonenumber panics on parsing crafted phonenumber inputs
published 2024-07-07 2 y ago modified 2026-10-13 26 d ago also EUVD-2024-2383 , GHSA-mjw4-jj88-v687 , RUSTSEC-2024-0369
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.
Patch / fix
- crates.io phonenumber 0.3.6
- whisperfish phonenumber 0.3.6
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| OSV | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | phonenumber | >=0.3.4, <0.3.6 >=0.3.3, <0.3.6 |
0.3.6 |
Affected products
- whisperfish rust-phonenumber
- whisperfish phonenumber
Classification
References
-
github.com
/whisperfish/rust-phonenumber/pull/52
web
-
github.com
/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203
web
-
github.com
/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407
web
-
github.com
/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687
web
-
github.com
/whisperfish/rust-phonenumber/issues/69
web, report
-
nvd.nist.gov
/vuln/detail/CVE-2024-39697
advisory
-
github.com
/whisperfish/rust-phonenumber
package
-
rustsec.org
/advisories/RUSTSEC-2024-0369.html
web, advisory
-
crates.io
/crates/phonenumber
package
-
cve.mitre.org
/cgi-bin/cvename.cgi?name=CVE-2024-39697
web
Sources
- CVE List CVE-2024-39697
- GitHub Advisory GHSA-mjw4-jj88-v687
- NVD CVE-2024-39697
- OSV RUSTSEC-2024-0369
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.