CVE-2026-77387
Description
A flaw was found in geopy. An attacker can cause a Denial of Service (DoS) by supplying excessively long or malformed coordinate strings to coordinate parsing functions such as Point.from_string() or reverse geocoding methods. Due to inefficient regular expression evaluation on unvalidated input, processing these requests consumes excessive CPU resources, causing the application to hang or become unresponsive.
Statement
A MODERATE severity regular expression denial of service (ReDoS) flaw was found in geopy, a Python geocoding library bundled in Red Hat AI Inference Server and Red Hat Enterprise Linux AI (RHEL AI) container images. When an application passes a long, malformed coordinate string to geopy.Point or Point.from_string(), inefficient regular-expression evaluation consumes excessive CPU time, which can cause the application to hang or become unresponsive; geocoder reverse methods that accept string coordinates also reach the vulnerable parsing path. The numeric Point constructor is not affected. Red Hat and the upstream CVE record both rate this flaw MODERATE with a CVSS 3.1 score of 4.0 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), so there is no difference from the upstream severity. All currently affected Red Hat products (Red Hat AI Inference Server and RHEL AI) are resolved as DEFER: because this is an availability-only issue of moderate severity with a CVSS score below 7.0, no fix is currently planned for the bundled geopy dependency in these products. The residual risk is CPU resource exhaustion and temporary denial of service of the process that parses attacker-controlled coordinate strings; there is no impact on confidentiality or integrity.
Mitigation
Applications can mitigate this issue by validating and limiting the length of coordinate strings (for example, rejecting inputs longer than 256 characters, matching the limit adopted by the upstream fix) before passing them to geopy.Point, Point.from_string(), or geocoder reverse methods, and by preferring the numeric Point constructor, which is not affected. Restricting or rate-limiting the sources of externally supplied coordinate strings further reduces exposure. The upstream geopy project addressed this issue in version 2.5.0.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4 | N/A | 4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
