CVE-2026-77399
Received Received - Intake

Path Traversal in icalendar Python Library

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77399
EUVD
EUVD-2026-84800

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
collective icalendar From 6.1.0 (inc)
collective icalendar From 7.0.0 (inc)
collective icalendar 7.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77399 is a denial-of-service vulnerability in the icalendar Python library affecting versions 6.1.0 and later. The issue arises from unbounded expansion of the VALARM REPEAT property, which controls how many times an alarm triggers after its initial activation. The library stores this value as a Python integer without enforcing the RFC 5545 limit of 2,147,483,647, allowing malicious calendar data to consume excessive memory during alarm time calculations.

Detection Guidance

To detect this vulnerability, monitor for excessive CPU or memory usage when processing iCalendar files. Check for applications using the icalendar library versions 6.1.0 to 7.2.1. Inspect logs for repeated alarm expansions or stalled services during calendar data processing.

Impact Analysis

This vulnerability can cause excessive CPU time and heap memory consumption, potentially terminating or stalling a service. A payload with a REPEAT value of 3,000,000 can exhaust 512MB of memory in under 5 seconds. It impacts applications processing untrusted calendar data, such as sync endpoints or scheduling services.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling calendar data. GDPR requires data protection and availability, while HIPAA mandates secure processing of health-related information. Uncontrolled resource consumption may lead to service disruptions, potentially violating availability requirements in these standards.

Mitigation Strategies
  • Upgrade the icalendar library to version 7.2.2 or later to apply the security fix.
  • If upgrading is not possible, implement input validation to cap or reject high REPEAT values in VALARM components before processing.
  • Set icalendar.config.MAX_ALARM_REPEAT to a reasonable limit (default is 10,000) to prevent unbounded expansions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77399. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart