import re
 
# quando o CPF é válido, ambas funcionam
cpf = '123.456.789-11'
print(re.match(r'\d{3}\.\d{3}\.\d{3}-\d{2}', cpf)) # encontra match
print(re.match(r'^\d{3}\.\d{3}\.\d{3}-\d{2}$', cpf)) # encontra match
 
# mas quando tem mais de 2 dígitos no final, a primeira encontra match (mas não deveria)
cpf = '123.456.789-111111111'
print(re.match(r'\d{3}\.\d{3}\.\d{3}-\d{2}', cpf)) # encontra match (mas não deveria)
print(re.match(r'^\d{3}\.\d{3}\.\d{3}-\d{2}$', cpf)) # None (OK, não é um CPF)

aW1wb3J0IHJlCgojIHF1YW5kbyBvIENQRiDDqSB2w6FsaWRvLCBhbWJhcyBmdW5jaW9uYW0KY3BmID0gJzEyMy40NTYuNzg5LTExJwpwcmludChyZS5tYXRjaChyJ1xkezN9XC5cZHszfVwuXGR7M30tXGR7Mn0nLCBjcGYpKSAjIGVuY29udHJhIG1hdGNoCnByaW50KHJlLm1hdGNoKHInXlxkezN9XC5cZHszfVwuXGR7M30tXGR7Mn0kJywgY3BmKSkgIyBlbmNvbnRyYSBtYXRjaAoKIyBtYXMgcXVhbmRvIHRlbSBtYWlzIGRlIDIgZMOtZ2l0b3Mgbm8gZmluYWwsIGEgcHJpbWVpcmEgZW5jb250cmEgbWF0Y2ggKG1hcyBuw6NvIGRldmVyaWEpCmNwZiA9ICcxMjMuNDU2Ljc4OS0xMTExMTExMTEnCnByaW50KHJlLm1hdGNoKHInXGR7M31cLlxkezN9XC5cZHszfS1cZHsyfScsIGNwZikpICMgZW5jb250cmEgbWF0Y2ggKG1hcyBuw6NvIGRldmVyaWEpCnByaW50KHJlLm1hdGNoKHInXlxkezN9XC5cZHszfVwuXGR7M30tXGR7Mn0kJywgY3BmKSkgIyBOb25lIChPSywgbsOjbyDDqSB1bSBDUEYp