CVE-2026-55099 Overview
CVE-2026-55099 is an algorithmic complexity vulnerability in the icalendar Python library, an RFC 5545 compatible parser and generator of iCalendar files. The flaw affects versions 7.1.0 through 7.1.2 and is fixed in 7.1.3. The Component.__eq__ method in src/icalendar/cal/component.py compares nested subcomponents using two membership loops that recursively invoke equality on child components. This produces O(2^n) work relative to nesting depth. An attacker can submit a sub-kilobyte .ics file containing equal, deeply nested BEGIN:VEVENT subtrees to pin a CPU core for minutes or indefinitely. The vulnerability is tracked as [CWE-400: Uncontrolled Resource Consumption].
Critical Impact
A few hundred bytes of crafted iCalendar input can exhaust CPU during equality, deduplication, or normalization comparisons, denying service to calendar sync, invite processing, and import endpoints.
Affected Products
- icalendar Python library version 7.1.0
- icalendar Python library versions 7.1.1 and 7.1.2
- Applications that perform equality, membership, deduplication, or normalization comparisons on parsed iCalendar components
Discovery Timeline
- 2026-08-25 - CVE-2026-55099 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-55099
Vulnerability Analysis
The defect lies in how Component.__eq__ compares two calendar components that contain subcomponents. The method iterates each subcomponent of one operand and tests membership in the other operand's subcomponent list. Each membership test invokes __eq__ again on child components, which repeats the same nested comparison. When both operands share identical deeply nested structure, the comparison work grows exponentially with nesting depth.
Parsing alone does not trigger the condition. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without enforcing a depth limit, so the malicious object materializes cheaply. Cost only manifests when application code compares two such objects, for example during deduplication, round-trip testing, cache lookups, or synchronization diffing. Comparisons that diverge early short-circuit, so the attacker crafts trees that remain equal for as long as possible.
Root Cause
The root cause is an unbounded recursive equality algorithm combined with the absence of a depth cap in Component.from_ical. Two nested membership loops that each recurse into child equality yield O(2^n) behavior. Neither a nesting-depth limit at parse time nor a memoized or iterative equality strategy is present in vulnerable releases.
Attack Vector
The attack vector is network reachable and requires no authentication or user interaction. Any endpoint that accepts an .ics payload and later compares the parsed object, such as calendar sync APIs, invite processors, import workflows, or test harnesses, is exposed. A sub-kilobyte file containing symmetric nested VEVENT subtrees is sufficient to pin a single worker or CPU core, degrading availability across shared services.
No verified public exploit code has been published. Technical detail is available in the GitHub Security Advisory GHSA-cv84-9p8j-fj68 and the corresponding Openwall OSS-Security discussion.
Detection Methods for CVE-2026-55099
Indicators of Compromise
- Sustained 100% CPU utilization on a single worker process handling calendar or .ics input.
- Request latency spikes or timeouts on calendar sync, invite processing, or .ics import endpoints without corresponding traffic volume.
- Small inbound .ics payloads (under 1 KB) that contain highly repetitive nested BEGIN:VEVENT and END:VEVENT sequences.
Detection Strategies
- Inspect inbound .ics traffic and flag payloads whose BEGIN:VEVENT nesting depth exceeds a small threshold, for example 5.
- Instrument the application to record wall-clock duration of any code path that invokes Component.__eq__ and alert on comparisons exceeding a defined budget.
- Track the version of the icalendar package in deployed environments and alert when it resolves to 7.1.0, 7.1.1, or 7.1.2.
Monitoring Recommendations
- Add per-request CPU and wall-time budgets around calendar parsing and comparison workers and terminate requests that exceed them.
- Emit structured logs including payload size, parse time, and comparison time for calendar operations to enable retrospective analysis.
- Monitor worker restart rates, request queue depth, and 5xx error ratios on services that process untrusted iCalendar data.
How to Mitigate CVE-2026-55099
Immediate Actions Required
- Upgrade icalendar to version 7.1.3 or later in all Python environments that process untrusted iCalendar input.
- Audit application code for uses of ==, !=, in, set(), deduplication, and assertion helpers on parsed Component objects.
- Enforce a maximum request-body size and a maximum processing time on endpoints that accept .ics uploads.
Patch Information
The issue is fixed in icalendar7.1.3. See the GitHub release for v7.1.3 and the underlying fix commit along with the related update commit. Upgrade using standard package tooling, for example pip install --upgrade 'icalendar>=7.1.3'.
Workarounds
- Reject .ics payloads whose BEGIN:VEVENT nesting depth exceeds a conservative threshold before invoking Component.from_ical.
- Avoid comparing untrusted Component objects directly; compare a normalized serialized form such as the output of to_ical() with a size cap.
- Run calendar parsing and comparison in an isolated worker with strict CPU and wall-time limits so a single malicious payload cannot exhaust shared resources.
# Configuration example
pip install --upgrade 'icalendar>=7.1.3'
pip show icalendar | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
