CVE catalog

CVE-2026-77387

Severity: Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Sep 8, 2026, 12:00:00 AM UTC
Updated: Oct 1, 2026, 5:17:31 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 25, 2026

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	geopy	sid	`2.4.1-3`	vulnerable
Debian	geopy	forky	`2.4.1-3`	vulnerable
Debian	geopy	trixie	`2.4.1-1`	vulnerable
Debian	geopy	bookworm	`2.3.0-1`	vulnerable
PyPI	geopy	Not reported	`0.92`	vulnerable
PyPI	geopy	Not reported	`0.93`	vulnerable
PyPI	geopy	Not reported	`0.94`	vulnerable
PyPI	geopy	Not reported	`0.94.1`	vulnerable
PyPI	geopy	Not reported	`0.94.2`	vulnerable
PyPI	geopy	Not reported	`0.95`	vulnerable
PyPI	geopy	Not reported	`0.95.1`	vulnerable
PyPI	geopy	Not reported	`0.96.0`	vulnerable
PyPI	geopy	Not reported	`0.96.1`	vulnerable
PyPI	geopy	Not reported	`0.96.2`	vulnerable
PyPI	geopy	Not reported	`0.96.3`	vulnerable
PyPI	geopy	Not reported	`0.97`	vulnerable
PyPI	geopy	Not reported	`0.97.1`	vulnerable
PyPI	geopy	Not reported	`0.98`	vulnerable
PyPI	geopy	Not reported	`0.98.1`	vulnerable
PyPI	geopy	Not reported	`0.98.2`	vulnerable
PyPI	geopy	Not reported	`0.98.3`	vulnerable
PyPI	geopy	Not reported	`0.99`	vulnerable
PyPI	geopy	Not reported	`1.0.0`	vulnerable
PyPI	geopy	Not reported	`1.0.1`	vulnerable
PyPI	geopy	Not reported	`1.1.0`	vulnerable
PyPI	geopy	Not reported	`1.1.1`	vulnerable
PyPI	geopy	Not reported	`1.1.2`	vulnerable
PyPI	geopy	Not reported	`1.1.3`	vulnerable
PyPI	geopy	Not reported	`1.1.4`	vulnerable
PyPI	geopy	Not reported	`1.1.5`	vulnerable
PyPI	geopy	Not reported	`1.10.0`	vulnerable
PyPI	geopy	Not reported	`1.11.0`	vulnerable
PyPI	geopy	Not reported	`1.12.0`	vulnerable
PyPI	geopy	Not reported	`1.13.0`	vulnerable
PyPI	geopy	Not reported	`1.14.0`	vulnerable
PyPI	geopy	Not reported	`1.15.0`	vulnerable
PyPI	geopy	Not reported	`1.16.0`	vulnerable
PyPI	geopy	Not reported	`1.17.0`	vulnerable
PyPI	geopy	Not reported	`1.18.0`	vulnerable
PyPI	geopy	Not reported	`1.18.1`	vulnerable
PyPI	geopy	Not reported	`1.19.0`	vulnerable
PyPI	geopy	Not reported	`1.2.0`	vulnerable
PyPI	geopy	Not reported	`1.20.0`	vulnerable
PyPI	geopy	Not reported	`1.21.0`	vulnerable
PyPI	geopy	Not reported	`1.22.0`	vulnerable
PyPI	geopy	Not reported	`1.23.0`	vulnerable
PyPI	geopy	Not reported	`1.3.0`	vulnerable
PyPI	geopy	Not reported	`1.4.0`	vulnerable
PyPI	geopy	Not reported	`1.5.0`	vulnerable
PyPI	geopy	Not reported	`1.6.0`	vulnerable
PyPI	geopy	Not reported	`1.6.1`	vulnerable
PyPI	geopy	Not reported	`1.7.0`	vulnerable
PyPI	geopy	Not reported	`1.7.1`	vulnerable
PyPI	geopy	Not reported	`1.8.0`	vulnerable
PyPI	geopy	Not reported	`1.8.1`	vulnerable
PyPI	geopy	Not reported	`1.9.0`	vulnerable
PyPI	geopy	Not reported	`1.9.1`	vulnerable
PyPI	geopy	Not reported	`2.0.0`	vulnerable
PyPI	geopy	Not reported	`2.0.0rc1`	vulnerable
PyPI	geopy	Not reported	`2.1.0`	vulnerable
PyPI	geopy	Not reported	`2.2.0`	vulnerable
PyPI	geopy	Not reported	`2.3.0`	vulnerable
PyPI	geopy	Not reported	`2.4.0`	vulnerable
PyPI	geopy	Not reported	`2.4.1`	vulnerable
PyPI	geopy	Not reported	`2.5.0`	fixed
PyPI	geopy	Not reported	`0.92`	vulnerable
PyPI	geopy	Not reported	`0.93`	vulnerable
PyPI	geopy	Not reported	`0.94`	vulnerable
PyPI	geopy	Not reported	`0.94.1`	vulnerable
PyPI	geopy	Not reported	`0.94.2`	vulnerable
PyPI	geopy	Not reported	`0.95`	vulnerable
PyPI	geopy	Not reported	`0.95.1`	vulnerable
PyPI	geopy	Not reported	`0.96.0`	vulnerable
PyPI	geopy	Not reported	`0.96.1`	vulnerable
PyPI	geopy	Not reported	`0.96.2`	vulnerable
PyPI	geopy	Not reported	`0.96.3`	vulnerable
PyPI	geopy	Not reported	`0.97`	vulnerable
PyPI	geopy	Not reported	`0.97.1`	vulnerable
PyPI	geopy	Not reported	`0.98`	vulnerable
PyPI	geopy	Not reported	`0.98.1`	vulnerable
PyPI	geopy	Not reported	`0.98.2`	vulnerable
PyPI	geopy	Not reported	`0.98.3`	vulnerable
PyPI	geopy	Not reported	`0.99`	vulnerable
PyPI	geopy	Not reported	`1.0.0`	vulnerable
PyPI	geopy	Not reported	`1.0.1`	vulnerable
PyPI	geopy	Not reported	`1.1.0`	vulnerable
PyPI	geopy	Not reported	`1.1.1`	vulnerable
PyPI	geopy	Not reported	`1.1.2`	vulnerable
PyPI	geopy	Not reported	`1.1.3`	vulnerable
PyPI	geopy	Not reported	`1.1.4`	vulnerable
PyPI	geopy	Not reported	`1.1.5`	vulnerable
PyPI	geopy	Not reported	`1.10.0`	vulnerable
PyPI	geopy	Not reported	`1.11.0`	vulnerable
PyPI	geopy	Not reported	`1.12.0`	vulnerable
PyPI	geopy	Not reported	`1.13.0`	vulnerable
PyPI	geopy	Not reported	`1.14.0`	vulnerable
PyPI	geopy	Not reported	`1.15.0`	vulnerable
PyPI	geopy	Not reported	`1.16.0`	vulnerable
PyPI	geopy	Not reported	`1.17.0`	vulnerable
PyPI	geopy	Not reported	`1.18.0`	vulnerable
PyPI	geopy	Not reported	`1.18.1`	vulnerable
PyPI	geopy	Not reported	`1.19.0`	vulnerable
PyPI	geopy	Not reported	`1.2.0`	vulnerable
PyPI	geopy	Not reported	`1.20.0`	vulnerable
PyPI	geopy	Not reported	`1.21.0`	vulnerable
PyPI	geopy	Not reported	`1.22.0`	vulnerable
PyPI	geopy	Not reported	`1.23.0`	vulnerable
PyPI	geopy	Not reported	`1.3.0`	vulnerable
PyPI	geopy	Not reported	`1.4.0`	vulnerable
PyPI	geopy	Not reported	`1.5.0`	vulnerable
PyPI	geopy	Not reported	`1.6.0`	vulnerable
PyPI	geopy	Not reported	`1.6.1`	vulnerable
PyPI	geopy	Not reported	`1.7.0`	vulnerable
PyPI	geopy	Not reported	`1.7.1`	vulnerable
PyPI	geopy	Not reported	`1.8.0`	vulnerable
PyPI	geopy	Not reported	`1.8.1`	vulnerable
PyPI	geopy	Not reported	`1.9.0`	vulnerable
PyPI	geopy	Not reported	`1.9.1`	vulnerable
PyPI	geopy	Not reported	`2.0.0`	vulnerable
PyPI	geopy	Not reported	`2.0.0rc1`	vulnerable
PyPI	geopy	Not reported	`2.1.0`	vulnerable
PyPI	geopy	Not reported	`2.2.0`	vulnerable
PyPI	geopy	Not reported	`2.3.0`	vulnerable
PyPI	geopy	Not reported	`2.4.0`	vulnerable
PyPI	geopy	Not reported	`2.4.1`	vulnerable
PyPI	geopy	Not reported	`2.5.0`	fixed
Opensuse	python-geopy	tumbleweed	`2.5.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	geopy	source	sid	`(unfixed)`	not yet assigned	Not reported	[1149676]
Debian	geopy	source	forky	`(unfixed)`	not yet assigned	Not reported	[1149676]
Debian	geopy	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149676]
Debian	geopy	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1149676]
PyPI	geopy	PyPI	Not reported	`2.5.0`	Not reported	GHSA-MHVH-FQ92-PFMR	Not reported
PyPI	geopy	PyPI	Not reported	`2.5.0`	Not reported	PYSEC-2026-4218	Not reported
Opensuse	python-geopy	rpm	tumbleweed	`2.5.0-1.1`	Not reported	OPENSUSE-SU-2026:11724-1	Not reported

[Debian bug #1149676]

Notes

[trixie] geopy: Minor issue [bookworm] geopy: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-geopy]Affected
Source package: [geopy]
Details (2)
- 2.3.0-1 · all · bookworm
  Affected
  nvd · geopy · debian · bookworm; nvd · geopy · debian · 12
- 2.3.0-1 · all · bookworm
  Affected
  nvd · geopy · debian · bookworm; nvd · geopy · debian · 12

[Debian 13 (Trixie)]

[python3-geopy]Affected
Source package: [geopy]
Details (2)
- 2.4.1-1 · all · trixie
  Affected
  nvd · geopy · debian · 13
- 2.4.1-1 · all · trixie
  Affected
  nvd · geopy · debian · 13

[openSUSE Tumbleweed]

[python313-geopy]Unknown
Source package: [python-geopy]
Details (1)
- 2.4.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 2.5.0-1.1
  Version impact unknown
  nvd · python-geopy · opensuse · tumbleweed
[python314-geopy]Unknown
Source package: [python-geopy]
Details (1)
- 2.4.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 2.5.0-1.1
  Version impact unknown
  nvd · python-geopy · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:29:12 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]