geopy CVE-2026-77387

The affected application must pass attacker-controlled string input into geopy.Point, Point.from_string(), or a geocoder reverse() method called with string (rather than numeric) arguments, on geopy < 2.5.0 without the 256-character input cap. The numeric Point constructor is unaffected and is not an exploitation path. Exploitation is limited by requiring that the application actually exposes one of these string-parsing entry points to untrusted input; deployments that only use numeric coordinates, validate/length-limit input upstream, or have upgraded to 2.5.0 are not exploitable. No authentication or user interaction is needed at the library level, but overall reachability depends on the host application's input handling.

This is a ReDoS (CWE-1333) denial-of-service issue in the geopy Python library (< 2.5.0) with a confirmed availability-only impact (C:N/I:N/A:L) and no code-execution or data-exposure risk. The supplied CVSS 3.1 vector rates it AV:L (local), yet the description explicitly states the vulnerable parsing path is reached via geocoder reverse methods and attacker-controlled string requests, which in a typical web/service deployment is network-reachable - CVSS indicates local vector but the description implies remote request-driven exploitation, so the AV:L rating likely understates reach for applications that pass untrusted strings to geopy. No EPSS score was provided, there is no CISA KEV listing, and no weaponized public exploit was supplied; the vendor PR/issue (#608, #610) does include a timing-based reproducer test demonstrating the slow-parse condition, but a reproducer is not the same as active exploitation. Net: this is a low-to-moderate real-world priority - a patched, availability-only library bug that matters chiefly where geopy parses untrusted input at scale, not a high-urgency critical issue.

An application exposes a geocoding feature that forwards user-supplied location strings into geopy.Point, Point.from_string(), or a geocoder reverse() call. An attacker repeatedly submits a long malformed coordinate string (e.g. a '<' followed by ~100,000 spaces and a trailing character), each request forcing catastrophic regex backtracking in POINT_PATTERN and pinning a CPU core for seconds. A modest volume of such requests exhausts worker threads and denies service to legitimate users; the vendor PR includes a timing reproducer but no weaponized exploit was provided.