The vulnerability resides in the geopy library’s Point.from_string parsing routine. When a very long, malformed coordinate string is supplied, the regular‑expression engine performs excessive backtracking, consuming large amounts of CPU time. This inefficiency can be triggered by repeated requests, causing the host process to hang and making the service unavailable. The numeric constructor for point objects is not affected, so the impact is limited to parsing functions that accept string input.

Affected versions are all releases of geopy prior to 2.5.0. The most common applications are Python scripts or web services that perform geocoding or reverse geocoding. Any environment that imports geopy and calls Point.from_string or reverse methods with external string data is potentially vulnerable. Upgrading to 2.5.0 or later resolves the issue because the fix introduces a 256‑character limit and more efficient regex handling.

The CVSS score is 4.0, indicating low severity, and no EPSS or KEV data are available. The vulnerability does not require any special privileges and can be triggered through normal input paths; therefore, if the library is exposed to user‑controlled data—as is common in web applications—the risk of denial of service remains. The attack is straightforward: craft a long coordinate string and send repeated requests to an application that uses the vulnerable parsing path.