CVE-2023-42444
Whisperfish Phonenumber ≤ 0.2.5\+8.11.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-42444 is a high-severity Uncaught Exception (CWE-248) vulnerability in Whisperfish Phonenumber. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2608
Vulnerability Data
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`,…
more
this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.7.2V1.4.2V2.2.1V2.2.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates alerting on audit failures, directly providing the missing report of the error condition.
Reporting the security and privacy status to organizational officials ensures monitoring and assessment results are communicated rather than omitted.
Requires reporting and escalation of error conditions and incidents per documented procedures.
IR testing would expose missing error reporting that prevents timely incident detection and response.
Offers direct support for reporting incidents, addressing the failure to report error conditions or security events.
Includes explicit reporting of security status and analysis results, addressing missing reports of error or monitoring conditions.
Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode.
Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Runtime monitoring can surface unreported errors only if the underlying code already emits them.
Requiring log generation directly forces error conditions to be reported so they become visible to monitoring.
Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.