Description

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T20:16:56.940Z",
  "pubdate": "2026-08-25T20:16:56.940Z",
  "executiveSummary": "The icalendar library is vulnerable to a Denial of Service (DoS) attack stemming from exponential time complexity in its component comparison logic. This vulnerability allows an attacker to exhaust CPU resources by submitting maliciously crafted, deeply nested iCalendar files.\nThe vulnerability type is algorithmic complexity (Denial of Service), specifically characterized by O(2^n) work relative to the nesting depth of components. This affects icalendar versions 7.1.0 through 7.1.3.\nAn attacker with the ability to supply an .ics file to an application—such as through calendar sync, invite processing, or import endpoints—can trigger this state without requiring authentication. By crafting a sub-kilobyte payload containing highly nested sub-components, an attacker can force a single comparison operation to pin a CPU core for minutes or even indefinitely.\nThis poses a critical risk to systems relying on icalendar for parsing or normalization of user-provided data. Because the vulnerability is triggered by common operations like equality, deduplication, or membership testing, it can be exploited in diverse application contexts. Remediation is required through upgrading the library, as the underlying recursive comparison logic must be fundamentally altered to prevent exponential recursion.",
  "technicalDetails": "The vulnerability resides in src/icalendar/cal/component.py within the Component equality method. The implementation utilizes a nested membership loop structure to compare subcomponents during equality checks. Because each membership test recursively invokes the same equality method on child components, the operation exhibits exponential time complexity—specifically O(2^n), where 'n' is the depth of the nested subcomponents.\nThe attack vector exploits the fact that Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without implementing a depth limit or stack control mechanism. An attacker can construct a compact .ics file of only a few hundred bytes containing deeply nested, structurally identical subtrees.\nWhen a vulnerable application performs operations that trigger the equality check—including direct equality (==), inequality (!=), membership testing (in), object deduplication, test-assertions, or round-trip normalization—the Python interpreter begins traversing the tree. For each layer of depth, the algorithm performs redundant comparisons that branch exponentially. A structure of moderate depth effectively forces the interpreter into a 'computationally hard' state where the number of recursive calls scales exponentially relative to the input size.\nThe attack flow follows these steps: 1) The attacker submits a specially crafted .ics file to the target service. 2) The service processes the file via Component.from_ical, which successfully builds the nested object tree in memory. 3) The service invokes a comparison-dependent operation, such as deduplication or equality testing, on the resulting object. 4) The nested membership loops in src/icalendar/cal/component.py initiate an exponential recursive descent. 5) The application's CPU usage spikes to 100% on the thread handling the request, rendering the service unresponsive to further requests while the computation persists. This effectively causes a resource exhaustion Denial of Service.\nThe vulnerability does not require authentication or elevated privileges, as it is reachable via any entry point that consumes and processes .ics data. Because the payload size is minimal (sub-kilobyte), it can bypass many standard network-based size filters, making it a highly efficient vector for triggering backend service instability."
}