CVE-2026-77387

Name of the Vulnerable Software and Affected Versions geopy versions prior to 2.5.0

Description Inefficient regular-expression behavior in geopy.Point and the Point.from string() function can lead to excessive CPU consumption when processing long, malformed coordinate strings. This issue also affects geocoder reverse methods when they are called with string inputs. An attacker can trigger a denial of service by sending repeated requests containing such strings. The numeric Point constructor is not affected.

Recommendations Update to version 2.5.0.