CVE-2026-77387 geopy CVE debrief

Who should care

Defenders responsible for applications using geopy, particularly those passing attacker-controlled strings to geopy APIs without length limits, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-77387 is a Regular Expression Denial of Service (ReDoS) vulnerability in geopy.Point. Defenders should verify geopy versions, update to 2.5.0 or later if vulnerable, and implement length limits for coordinate strings to prevent denial of service risks.

• Denial of service through repeated requests with malformed coordinate strings
• Potential for excessive CPU time consumption leading to performance degradation
• Need for verification of geopy versions and implementation of coordinate string length limits

Technical summary

The geopy library is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in the geopy.Point class. This occurs when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The issue is fixed in geopy 2.5.0, which rejects overly long coordinate strings before parsing. The vulnerability affects geopy versions prior to 2.5.0, where the numeric Point constructor is not affected but geocoders' reverse methods called with string inputs exercise the vulnerable path. Applications are affected when they pass attacker-controlled strings to these APIs without an appropriate length limit, potentially leading to denial of service through repeated requests.

Defensive priority

Defenders should prioritize verifying geopy versions and updating to 2.5.0 or later if vulnerable. Limiting coordinate string lengths can mitigate the issue.

Recommended defensive actions

• Verify geopy versions in use and update to 2.5.0 or later if vulnerable
• Implement length limits for coordinate strings to prevent excessive CPU time
• Review applications using geopy for potential denial of service risks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides details on the Regular Expression Denial of Service (ReDoS) vulnerability in geopy.Point. It mentions that the issue is fixed in geopy 2.5.0 and suggests limiting coordinate strings to a reasonable maximum length as a workaround.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.