CVE-2026-77387
Medium
Description
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.
SeverityMedium
CVSS4.0
Exploit probability—
ProductGeopy
PublishedOct 1, 2026
First seenOct 1, 2026
Weakness typeCWE-1333CWE-1333
How to fix
Update
- geopy2.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geopyPyPI | v < 2.5.0 | 2.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.