geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.

Affected: PyPI: geopy

### Impact

`geopy.Point` and `Point.from_string()` may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected.

Geocoders' `reverse` methods called with string inputs exercise the vulnerable path.

Applications are affected when they pass attacker-controlled strings to these APIs without an appropriate length limit. Repeated requests may cause denial of service.

### Patches

Fixed in geopy **2.5.0** by rejecting overly long (over 256 characters) coordinate strings before parsing.

### Workarounds

Limit coordinate strings to a reasonable maximum length, such as 256 characters, before passing them to geopy.

python313-geopy-2.5.0-1.1 on GA media

Affected: Ubuntu:16.04:LTS: geopy, Ubuntu:18.04:LTS: geopy, Ubuntu:20.04:LTS: geopy, Ubuntu:22.04:LTS: geopy, Ubuntu:24.04:LTS: geopy, Ubuntu:26.04:LTS: geopy

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.