Denial of Service Vulnerability in icalendar Python Library

The Python library icalendar (versions 7.1.0 through 7.1.2) contains an algorithmic complexity vulnerability in its Component.__eq__ method, which is used for comparing iCalendar objects. The vulnerability exists because the library performs recursive equality checks on nested subcomponents with an O(2^n) time complexity. By supplying a specially crafted iCalendar file containing deeply nested components, an attacker can trigger a denial-of-service condition, causing the application to consume excessive CPU resources and hang indefinitely during equality or membership comparison operations.

This issue is significant for any application that processes untrusted iCalendar data and subsequently performs comparison operations such as ==, !=, or membership tests (e.g., in sets or dictionaries), including services that perform deduplication, calendar synchronization, or normalization checks. The vulnerability is triggered only when comparison logic is executed on the parsed structure, not during the parsing phase itself.

Impact

The vulnerability results in an algorithmic-complexity denial of service (CWE-407). A malicious actor can execute this attack without authentication by submitting an iCalendar file of less than 1KB. This single request can pin a CPU core for minutes, resulting in service unavailability. The impact is widespread among applications relying on the icalendar library for handling invites or calendar imports, particularly if the application performs automatic round-trip normalization or deduplication.

Recommendation

• Update the icalendar package to version 7.1.3 or later where the equality logic has been refactored to use an explicit stack to walk components, reducing complexity to linear time.
• Audit applications that use the icalendar library to identify code paths where Component objects are compared for equality, added to sets, or used in membership tests using input from untrusted sources.
• Implement input validation to restrict the depth of nested components in incoming iCalendar files before passing them to the library for processing.