AIKIDO-2026-961237
pygeohash is vulnerable to Stack-based Buffer Overflow
59
Medium Risk
This Affects:
pygeohashTL;DR
The C extension encode functions in pygeohash write geohash characters into a fixed-size 13-byte stack buffer while looping up to the caller-supplied precision, without validating precision. Calling the low-level C module directly with a precision of 13 or greater overruns the stack buffer, causing memory corruption or a crash. The same encoders also fail to reject non-finite coordinates, so an infinite longitude drives the normalization loop into an unterminated loop that hangs the call. The fix rejects precision outside 1-12 and rejects NaN and infinite coordinates with a ValueError before any buffer write.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application calls the low-level pygeohash.cgeohash.geohash_module encode functions directly with attacker-influenced precision or coordinates.
Background info
pygeohash is vulnerable to Stack-based Buffer Overflow in versions 3.0.0 - 3.3.0.
How to fix this
Upgrade the pygeohash library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant