AIKIDO-2026-829845

TL;DR

geopy.Point.from_string parses coordinate strings using a regular expression that exhibits catastrophic backtracking on long, malformed inputs. An attacker who can supply an arbitrarily long coordinate-like string to any code path that calls from_string — including reverse geocoder results — can cause the regex engine to consume excessive CPU and hang the process. The fix enforces a hard input length limit of 256 characters and raises ValueError for longer strings before the regex is applied.