Executive brief
The icalendar library used to parse and process calendar files contains a flaw in how it compares calendar components for equality. An attacker can upload a specially crafted calendar file with nested structures that causes equality checks to take minutes or hang indefinitely, consuming CPU and making the service unresponsive. Any application that parses untrusted calendar data and compares components—such as calendar sync endpoints, invite processors, or deduplication logic—is vulnerable to this denial-of-service attack.
Technical details
The vulnerability is an algorithmic-complexity denial of service (CWE-407) in the Component.__eq__ method (src/icalendar/cal/component.py:642-665). The implementation checks set-equivalence of subcomponents using two nested membership loops that recursively invoke __eq__ on children. For a nested chain of depth n, this produces T(n) = 2·T(n-1), resulting in exponential O(2^n) time complexity. The parser does not impose depth limits, allowing BEGIN:VEVENT blocks to nest arbitrarily. Exploitation requires crafting a .ics file with deeply nested equal subtrees; a single ~800 B payload with depth 30 can trigger ~13 minutes of computation. The flaw is not triggered by parsing alone—only by subsequent equality comparisons, membership tests, deduplication, or round-trip checks. Authentication is not required. The fix (version 7.1.3) rewrites __eq__ to use an explicit stack instead of recursion, reducing complexity to O(n).
Affected products
- collective icalendar >=7.1.0, <7.1.3
Timeline
- 2026-06-15: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Version 7.1.3 released with fix