All vulnerabilities
CVE-2026-77387GHSA-mhvh-fq92-pfmrPYSEC-2026-4218

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy geopypipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.5.0Fixed versionGitHub
Published1 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 2.5.0geopy, pipGitHub
  • 2.5.0geopy, PyPIOSVpip install "geopy>=2.5.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

geopy.Point and Point.from_string() may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected.

Geocoders' reverse methods called with string inputs exercise the vulnerable path.

Applications are affected when they pass attacker-controlled strings to these APIs without an appropriate length limit. Repeated requests may cause denial of service.

Patches

Fixed in geopy 2.5.0 by rejecting overly long (over 256 characters) coordinate strings before parsing.

Workarounds

Limit coordinate strings to a reasonable maximum length, such as 256 characters, before passing them to geopy.

Text from GitHub Advisory Database

Affected versions 53

  • geopy, pip<= 2.4.1GitHub
  • geopyaffected: < 2.5.0CVE List
  • geopy, PyPIfrom first release, fixed in 2.5.0OSV
  • geopy, PyPI0.92OSV
  • geopy, PyPI0.93OSV
  • geopy, PyPI0.94OSV
  • geopy, PyPI0.94.1OSV
  • geopy, PyPI0.94.2OSV
  • geopy, PyPI0.95OSV
  • geopy, PyPI0.95.1OSV
  • geopy, PyPI0.96.0OSV
  • geopy, PyPI0.96.1OSV
  • geopy, PyPI0.96.2OSV
  • geopy, PyPI0.96.3OSV
  • geopy, PyPI0.97OSV
  • geopy, PyPI0.97.1OSV
  • geopy, PyPI0.98OSV
  • geopy, PyPI0.98.1OSV
  • geopy, PyPI0.98.2OSV
  • geopy, PyPI0.98.3OSV
  • geopy, PyPI0.99OSV
  • geopy, PyPI1.0.0OSV
  • geopy, PyPI1.0.1OSV
  • geopy, PyPI1.1.0OSV
  • geopy, PyPI1.1.1OSV
  • geopy, PyPI1.1.2OSV
  • geopy, PyPI1.1.3OSV
  • geopy, PyPI1.1.4OSV
  • geopy, PyPI1.1.5OSV
  • geopy, PyPI1.10.0OSV
  • geopy, PyPI1.11.0OSV
  • geopy, PyPI1.12.0OSV
  • geopy, PyPI1.13.0OSV
  • geopy, PyPI1.14.0OSV
  • geopy, PyPI1.15.0OSV
  • geopy, PyPI1.16.0OSV
  • geopy, PyPI1.17.0OSV
  • geopy, PyPI1.18.0OSV
  • geopy, PyPI1.18.1OSV
  • geopy, PyPI1.19.0OSV
  • geopy, PyPI1.2.0OSV
  • geopy, PyPI1.20.0OSV
  • geopy, PyPI1.21.0OSV
  • geopy, PyPI1.22.0OSV
  • geopy, PyPI1.23.0OSV
  • geopy, PyPI1.3.0OSV
  • geopy, PyPI1.4.0OSV
  • geopy, PyPI1.5.0OSV
  • geopy, PyPI1.6.0OSV
  • geopy, PyPI1.6.1OSV
  • geopy, PyPI1.7.0OSV
  • geopy, PyPI1.7.1OSV
  • geopy, PyPI1.8.0OSV

References 7