Vulnerability-Lookup

CVE-2026-55099 (GCVE-0-2026-55099)

Vulnerability from cvelistv5 – Published: 2026-08-25 19:27 – Updated: 2026-08-26 15:05

Title

icalendar: Algorithmic Complexity in Equality

Summary

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:05 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/collective/icalendar/security/…	x_refsource_CONFIRM
https://github.com/collective/icalendar/commit/b6…	x_refsource_MISC
https://github.com/collective/icalendar/commit/ca…	x_refsource_MISC
https://github.com/collective/icalendar/releases/…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/06/23/8

Impacted products

1 product

Vendor	Product	Version	CPE status
collective	icalendar	Affected: >= 7.1.0, < 7.1.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-25T20:10:56.453Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/23/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55099",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:05:19.449076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:05:26.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "icalendar",
          "vendor": "collective",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.1.0, \u003c 7.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T19:27:02.236Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68"
        },
        {
          "name": "https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49"
        },
        {
          "name": "https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79"
        },
        {
          "name": "https://github.com/collective/icalendar/releases/tag/v7.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/collective/icalendar/releases/tag/v7.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-cv84-9p8j-fj68",
        "discovery": "UNKNOWN"
      },
      "title": "icalendar: Algorithmic Complexity in Equality"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55099",
    "datePublished": "2026-08-25T19:27:02.236Z",
    "dateReserved": "2026-06-16T14:41:54.579Z",
    "dateUpdated": "2026-08-26T15:05:26.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55099",
      "date": "2026-08-31",
      "epss": "0.00384",
      "percentile": "0.31438"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55099\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-25T20:16:56.940\",\"lastModified\":\"2026-08-26T16:16:28.197\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"collective\",\"product\":\"icalendar\",\"versions\":[{\"version\":\"\u003e= 7.1.0, \u003c 7.1.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T15:05:19.449076Z\",\"id\":\"CVE-2026-55099\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-407\"}]}],\"references\":[{\"url\":\"https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/collective/icalendar/releases/tag/v7.1.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68\",\"source\":\"security-advisories@github.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/06/23/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/06/23/8\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-08-25T20:10:56.453Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55099\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T15:05:19.449076Z\"}}}], \"references\": [{\"url\": \"https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T15:04:56.585Z\"}}], \"cna\": {\"title\": \"icalendar: Algorithmic Complexity in Equality\", \"source\": {\"advisory\": \"GHSA-cv84-9p8j-fj68\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"collective\", \"product\": \"icalendar\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 7.1.0, \u003c 7.1.3\"}]}], \"references\": [{\"url\": \"https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68\", \"name\": \"https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49\", \"name\": \"https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79\", \"name\": \"https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/collective/icalendar/releases/tag/v7.1.3\", \"name\": \"https://github.com/collective/icalendar/releases/tag/v7.1.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-407\", \"description\": \"CWE-407: Inefficient Algorithmic Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-25T19:27:02.236Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55099\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T15:05:26.062Z\", \"dateReserved\": \"2026-06-16T14:41:54.579Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-25T19:27:02.236Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55099

Vulnerability from fkie_nvd - Published: 2026-08-25 20:16 - Updated: 2026-08-26 16:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49
	security-advisories@github.com	https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79
	security-advisories@github.com	https://github.com/collective/icalendar/releases/tag/v7.1.3
	security-advisories@github.com	https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/06/23/8
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "icalendar",
          "vendor": "collective",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.1.0, \u003c 7.1.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3."
    }
  ],
  "id": "CVE-2026-55099",
  "lastModified": "2026-08-26T16:16:28.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55099",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T15:05:19.449076Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T20:16:56.940",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/collective/icalendar/releases/tag/v7.1.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/23/8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CV84-9P8J-FJ68

Vulnerability from github – Published: 2026-08-25 19:27 – Updated: 2026-08-25 19:27

Summary

icalendar has Algorithmic Complexity in Equality

Details

Summary

Component.__eq__ compares subcomponents in O(2^n) time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (==, !=, in, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.

Details

Component subclasses dict and stores children in a separate subcomponents list. __eq__ (src/icalendar/cal/component.py:642-665) checks set-equivalence of children with two membership loops:

def __eq__(self, other):
    if len(self.subcomponents) != len(other.subcomponents):
        return False
    if not super().__eq__(other):
        return False
    for subcomponent in self.subcomponents:
        if subcomponent not in other.subcomponents:
            return False
    for subcomponent in other.subcomponents:
        if subcomponent not in self.subcomponents:
            return False
    return True

Each ... not in ... test invokes __eq__ on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: T(n) = 2·T(n-1) → O(2^n).

Parsing does not gate this. Component.from_ical builds the structure iteratively and imposes no depth limit, so BEGIN:VEVENT blocks can be nested to any depth (parsing the payload below is instant). The cost is paid only when a comparison occurs, and only when the operands are equal far enough down to keep both loops recursing, a condition the attacker controls by submitting equal subtrees.

PoC

from icalendar import Calendar

d = 26
event = b"BEGIN:VEVENT\r\n" * d + b"END:VEVENT\r\n" * d
ics = b"BEGIN:VCALENDAR\r\n" + event + event + b"END:VCALENDAR\r\n"

cal = Calendar.from_ical(ics)
a, b = cal.subcomponents
a == b

Measured on icalendar 7.1.x, CPython 3.14:

Payload	Depth	`==` time
552 B	20	0.76 s
656 B	24	12 s
708 B	26	48 s
~800 B	30	~13 min

A single uploaded file supplies both operands (two identical nested events), so no second input is needed. The same blowup occurs in round-trip checks (cal == Calendar.from_ical(cal.to_ical())) and in any membership/dedup logic over subcomponents.

Impact

Algorithmic-complexity denial of service (CWE-407). Unauthenticated; a few hundred bytes of input pin a CPU core indefinitely. It affects any service that parses untrusted iCalendar data and then compares components for equality or membership, including calendar sync/import endpoints, invite processing, dedup, and round-trip/normalization checks. It is not triggered by parsing alone, and a comparison against an early-differing object short-circuits harmlessly, so impact is limited to code paths that perform such comparisons.

Fix

Component.__eq__ rewritten to walk an explicit stack instead of recursing, matching each pair of nested components exactly once. Equality is now linear in the number of components and preserves the existing multiset equivalence and commutativity semantics.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "icalendar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55099"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T19:27:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte `.ics` file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (`==`, `!=`, `in`, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.\n\n### Details\n\n`Component` subclasses `dict` and stores children in a separate `subcomponents` list. `__eq__` (`src/icalendar/cal/component.py:642-665`) checks set-equivalence of children with two membership loops:\n\n```python\ndef __eq__(self, other):\n    if len(self.subcomponents) != len(other.subcomponents):\n        return False\n    if not super().__eq__(other):\n        return False\n    for subcomponent in self.subcomponents:\n        if subcomponent not in other.subcomponents:\n            return False\n    for subcomponent in other.subcomponents:\n        if subcomponent not in self.subcomponents:\n            return False\n    return True\n```\n\nEach `... not in ...` test invokes `__eq__` on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: `T(n) = 2\u00b7T(n-1)` \u2192 `O(2^n)`.\n\nParsing does not gate this. `Component.from_ical` builds the structure iteratively and imposes no depth limit, so `BEGIN:VEVENT` blocks can be nested to any depth (parsing the payload below is instant). The cost is paid only when a comparison occurs, and only when the operands are equal far enough down to keep both loops recursing, a condition the attacker controls by submitting equal subtrees.\n\n### PoC\n\n```python\nfrom icalendar import Calendar\n\nd = 26\nevent = b\"BEGIN:VEVENT\\r\\n\" * d + b\"END:VEVENT\\r\\n\" * d\nics = b\"BEGIN:VCALENDAR\\r\\n\" + event + event + b\"END:VCALENDAR\\r\\n\"\n\ncal = Calendar.from_ical(ics)\na, b = cal.subcomponents\na == b\n```\n\nMeasured on `icalendar` 7.1.x, CPython 3.14:\n\n| Payload | Depth | `==` time |\n|---|---|---|\n| 552 B | 20 | 0.76 s |\n| 656 B | 24 | 12 s |\n| 708 B | 26 | 48 s |\n| ~800 B | 30 | ~13 min |\n\nA single uploaded file supplies both operands (two identical nested events), so no second input is needed. The same blowup occurs in round-trip checks (`cal == Calendar.from_ical(cal.to_ical())`) and in any membership/dedup logic over subcomponents.\n\n### Impact\n\nAlgorithmic-complexity denial of service (CWE-407). Unauthenticated; a few hundred bytes of input pin a CPU core indefinitely. It affects any service that parses untrusted iCalendar data and then compares components for equality or membership, including calendar sync/import endpoints, invite processing, dedup, and round-trip/normalization checks. It is not triggered by parsing alone, and a comparison against an early-differing object short-circuits harmlessly, so impact is limited to code paths that perform such comparisons.\n\n### Fix\n\n`Component.__eq__` rewritten to walk an explicit stack instead of recursing, matching each pair of nested components exactly once. Equality is now linear in the number of components and preserves the existing multiset equivalence and commutativity semantics.",
  "id": "GHSA-cv84-9p8j-fj68",
  "modified": "2026-08-25T19:27:31Z",
  "published": "2026-08-25T19:27:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/collective/icalendar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/collective/icalendar/releases/tag/v7.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "icalendar has Algorithmic Complexity in Equality"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55099 (GCVE-0-2026-55099)

FKIE_CVE-2026-55099

GHSA-CV84-9P8J-FJ68

Summary

Details

PoC

Impact

Fix

Tags

Sightings

Nomenclature