Inefficient Regular Expressions in Geopy Geocoding Library for Python

CVE-2026-77387

What is CVE-2026-77387?

The Geopy library for Python has a vulnerability that allows excessive CPU consumption when processing long malformed coordinate strings. The Point and Point.from_string() methods can lead to denial of service if manipulated with user-controlled input. This issue arises due to inefficient regular expression handling, allowing for repeated requests to overwhelm the application. The numeric Point constructor remains unaffected, but developers should update to version 2.5.0 or later to mitigate these risks.

References