{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/icalendar-7.1.0-to-7.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-55099"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["icalendar (7.1.0 to 7.1.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Python library \u003ccode\u003eicalendar\u003c/code\u003e (versions 7.1.0 through 7.1.2) contains an algorithmic complexity vulnerability in its \u003ccode\u003eComponent.__eq__\u003c/code\u003e method, which is used for comparing iCalendar objects. The vulnerability exists because the library performs recursive equality checks on nested subcomponents with an O(2^n) time complexity. By supplying a specially crafted iCalendar file containing deeply nested components, an attacker can trigger a denial-of-service condition, causing the application to consume excessive CPU resources and hang indefinitely during equality or membership comparison operations.\u003c/p\u003e\n\u003cp\u003eThis issue is significant for any application that processes untrusted iCalendar data and subsequently performs comparison operations such as \u003ccode\u003e==\u003c/code\u003e, \u003ccode\u003e!=\u003c/code\u003e, or membership tests (e.g., in sets or dictionaries), including services that perform deduplication, calendar synchronization, or normalization checks. The vulnerability is triggered only when comparison logic is executed on the parsed structure, not during the parsing phase itself.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in an algorithmic-complexity denial of service (CWE-407). A malicious actor can execute this attack without authentication by submitting an iCalendar file of less than 1KB. This single request can pin a CPU core for minutes, resulting in service unavailability. The impact is widespread among applications relying on the \u003ccode\u003eicalendar\u003c/code\u003e library for handling invites or calendar imports, particularly if the application performs automatic round-trip normalization or deduplication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003eicalendar\u003c/code\u003e package to version 7.1.3 or later where the equality logic has been refactored to use an explicit stack to walk components, reducing complexity to linear time.\u003c/li\u003e\n\u003cli\u003eAudit applications that use the \u003ccode\u003eicalendar\u003c/code\u003e library to identify code paths where \u003ccode\u003eComponent\u003c/code\u003e objects are compared for equality, added to sets, or used in membership tests using input from untrusted sources.\u003c/li\u003e\n\u003cli\u003eImplement input validation to restrict the depth of nested components in incoming iCalendar files before passing them to the library for processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-26T00:50:55Z","date_published":"2026-08-26T00:50:55Z","id":"https://feed.craftedsignal.io/briefs/2026-08-icalendar-algorithmic-complexity/","summary":"The icalendar Python library contains an algorithmic complexity vulnerability (CVE-2026-55099) in the Component.__eq__ method that allows for denial of service via deeply nested subcomponents.","title":"Denial of Service Vulnerability in icalendar Python Library","url":"https://feed.craftedsignal.io/briefs/2026-08-icalendar-algorithmic-complexity/"}],"language":"en","title":"CraftedSignal Threat Feed - Icalendar (7.1.0 to 7.1.2)","version":"https://jsonfeed.org/version/1.1"}