Executive brief
icalendar is a Python library for parsing and generating calendar files. Versions 6.1.0 through 7.2.1 contain a vulnerability where specially crafted calendar files with a malicious REPEAT value in alarm definitions can cause excessive CPU consumption and memory usage when applications access alarm properties. An attacker who can supply a crafted calendar file could cause a service to become unresponsive or crash.
Technical details
The vInt.from_ical method in icalendar fails to limit the expansion of the VALARM REPEAT value, allowing unbounded iteration when properties like Alarms.times, Alarms.active (6.1.0+) or Alarm.triggers (7.0.0+) are accessed. The vulnerability requires an attacker-controlled iCalendar file and application code that accesses these alarm properties, not just parsing. A fix capping the REPEAT expansion is available in version 7.2.2.
Affected products
- collective icalendar 6.1.0 to 7.2.1
Timeline
- 2026-09-22: disclosed