Denial of Service Vulnerability in iCalendar Parser by Collective

CVE-2026-55099

What is CVE-2026-55099?

The iCalendar parser for Python, developed by Collective, is susceptible to a denial of service due to inefficient handling of nested subcomponents in its comparison methods. Specifically, versions from 7.1.0 to 7.1.3 exhibit exponential processing behavior when evaluating component equality, particularly triggered by complex nested BEGIN:VEVENT blocks. An attacker can manipulate this vulnerability by submitting a crafted .ics file, potentially consuming significant CPU resources for prolonged periods during calendar sync or import operations. This issue has been resolved in version 7.1.3 with optimizations to the comparison logic.

References