High, CVSS 7.5PyPIPublished
icalendar has Algorithmic Complexity in Equality
CVE-2026-55099 · GHSA-cv84-9p8j-fj68
- Affected
- PyPI icalendar >= 7.1.0, < 7.1.3
- Fixed in
- 7.1.3· Vendor fix available
- Issue
- Component.eq compares subcomponents in O(2^n) time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (==, !=, in, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service. Details Component subclasses dict and stores children in a separate subcomponents list. eq (src/icalendar/cal/component.py:642-665) checks set-equivalence of children with two membership loops: Each ... not in ... test invokes eq on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: T(n) = 2·T(n-1) → O(2^n). Parsing does not gate this. Component.fromical builds the structure iteratively and imposes no depth limit, so BEGIN:VEVENT blocks can be nested to any depth (parsing the payload below…
Recommended action: Upgrade to 7.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.