CVE-2026-77387: geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
geopy.Point and Point.from_string() may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected.
Geocoders’ reverse methods called with string inputs exercise the vulnerable path.
Applications are affected when they pass attacker-controlled strings to these APIs without an appropriate length limit. Repeated requests may cause denial of service.
References
- github.com/advisories/GHSA-mhvh-fq92-pfmr
- github.com/geopy/geopy/commit/5d09fa843f90ec80788b61552539c9fd3ae6c528
- github.com/geopy/geopy/issues/608
- github.com/geopy/geopy/pull/610
- github.com/geopy/geopy/releases/tag/2.5.0
- github.com/geopy/geopy/security/advisories/GHSA-mhvh-fq92-pfmr
- nvd.nist.gov/vuln/detail/CVE-2026-77387
Code Behaviors & Features
Detect and mitigate CVE-2026-77387 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →