Geopy
Monthly
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.