CVE-2026-55099
Received Received - Intake

Denial of Service in icalendar Component Equality Comparison

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55099
EUVD
EUVD-2026-65743

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
collective icalendar 7.1.0
collective icalendar 7.1.1
collective icalendar 7.1.2
collective icalendar From 7.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in the icalendar Python library. It occurs when comparing nested iCalendar components due to inefficient equality checks that cause exponential time complexity. An attacker can exploit this by submitting a maliciously crafted .ics file with deeply nested structures, causing CPU exhaustion during comparisons.

Detection Guidance

This vulnerability can be detected by checking the version of the icalendar library in use. If your system uses version 7.1.0 to 7.1.3, it is vulnerable. Run: pip show icalendar to check the installed version.

Impact Analysis

If you use the affected icalendar library versions (7.1.0 to 7.1.3), an attacker could send a small malicious .ics file to your application. When your system processes or compares calendar data, it may consume excessive CPU resources, leading to service slowdowns or crashes in calendar sync, import, or invite processing features.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions in systems handling sensitive data. For GDPR, availability issues may violate Article 32 requirements for data security. For HIPAA, downtime in healthcare systems could disrupt access to protected health information, potentially violating integrity and availability requirements.

Mitigation Strategies

Upgrade the icalendar library to version 7.1.3 or later immediately. Use: pip install --upgrade icalendar. If upgrading is not possible, restrict network access to endpoints using the library or implement input validation for .ics files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart