CVE-2026-77387

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.

• CWE-1333

• https://github.com/geopy/geopy/commit/5d09fa843f90ec80788b61552539c9fd3ae6c528
• https://github.com/geopy/geopy/issues/608
• https://github.com/geopy/geopy/pull/610
• https://github.com/geopy/geopy/releases/tag/2.5.0
• https://github.com/geopy/geopy/security/advisories/GHSA-mhvh-fq92-pfmr
• https://github.com/geopy/geopy/issues/608

Published

Oct 1, 2026

Last Modified

Oct 2, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7737A vulnerability was identified in osrg GoBGP up to 4.3.0. Af…7.5
• CVE-2026-77375SFTPGo is an open source, event-driven file transfer solutio…6.5
• CVE-2026-7738A security flaw has been discovered in puchunjie doc-tools-m…6.3
• CVE-2026-77384libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-77385Kyoo is a self-hosted media server focused on movies, series…4.3
• CVE-2026-77386Kyoo is a self-hosted media server focused on movies, series…6.5
• CVE-2026-7739A weakness has been identified in justdan96 tsMuxer up to 2.…3.3
• CVE-2026-77391A security flaw has been discovered in SourceCodester Dynami…4.3
• CVE-2026-77392A weakness has been identified in SourceCodester Dynamic Inp…6.3
• CVE-2026-77393In Ignition 8.1.53 and earlier, the Gateway "Create Project …8.8
• CVE-2026-77394OpenC3 COSMOS provides the functionality needed to send comm…7.6
• CVE-2026-77396PJSIP is a free and open source multimedia communication lib…6.9