Excessive Resource Consumption in iCalendar Parser by Collective

CVE-2026-77399

What is CVE-2026-77399?

The iCalendar library for Python, versions 6.1.0 to 7.2.2, contains a vulnerability in the vInt.from_ical method that allows an attacker to exploit a controllable VALARM REPEAT value. This flaw enables unbounded expansion of alarm properties, leading to excessive CPU consumption and potential service stall or termination when accessing alarms.times and alarms.active properties. The issue can be particularly severe for applications requesting alarm times without proper restrictions. The vulnerability was resolved in version 7.2.2.

References