CVE-2026-77399: Python iCalendar Parser DoS Vulnerability

CVE-2026-77399 Overview

CVE-2026-77399 is an uncontrolled resource consumption vulnerability [CWE-400] in the icalendar Python library, an RFC 5545 compatible parser and generator of iCalendar files. The flaw exists in vInt.from_ical, which accepts an attacker-controlled VALARM REPEAT value without enforcing an application-level limit. Applications that request alarm times can eagerly expand this value, consuming excessive CPU time and heap memory. Affected code paths include Alarms.times and Alarms.active beginning in version 6.1.0, and Alarm.triggers beginning in version 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can stall or terminate a service. The maintainers fixed the issue in version 7.2.2.

Critical Impact
A remote authenticated attacker can submit a crafted iCalendar file with an oversized VALARM REPEAT value to exhaust CPU and memory, causing denial of service in applications that process alarm properties.

Affected Products

icalendar Python library versions 6.1.0 through 7.2.1 (affecting Alarms.times and Alarms.active)
icalendar Python library versions 7.0.0 through 7.2.1 (additionally affecting Alarm.triggers)
Any Python application that ingests untrusted iCalendar data and accesses alarm expansion properties

Discovery Timeline

2026-09-22 - CVE-2026-77399 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77399

Vulnerability Analysis

The vulnerability resides in how the icalendar library handles the REPEAT property inside a VALARM component. RFC 5545 defines REPEAT as an integer specifying how many additional times an alarm should repeat after its initial trigger. The library's vInt.from_ical method parses this integer without any upper bound. When application code requests expanded alarm data through Alarms.times, Alarms.active, or Alarm.triggers, the library iterates the full repeat count and materializes each occurrence. An attacker supplying a value such as REPEAT:2147483647 forces the library to allocate memory and consume CPU proportional to that integer.

Root Cause

The root cause is missing input validation on the REPEAT integer during alarm expansion. The parser accepts any valid integer, and downstream consumers eagerly expand the repetition sequence in memory rather than lazily or with a bounded ceiling. The fix introduces a _clamp_repeat helper in icalendar.config that caps the effective repeat count during expansion in src/icalendar/alarms.py.

Attack Vector

Exploitation requires an attacker to submit an iCalendar file containing a VALARM component with a large REPEAT value to a target application that later invokes alarm expansion. Typical targets include calendar servers, scheduling APIs, email processors, and CalDAV endpoints that ingest user-supplied .ics content. The attack requires low privileges but no user interaction, and impacts availability only. Confidentiality and integrity remain unaffected.

python

# Security patch in src/icalendar/alarms.py
# Fix GHSA-qjcq-q7h7-r74v: cap VALARM REPEAT expansion

from icalendar.cal.event import Event
from icalendar.cal.todo import Todo
from icalendar.config import _clamp_repeat
from icalendar.error import (
    ComponentEndMissing,
    ComponentStartMissing,
)
# Source: https://github.com/collective/icalendar/commit/157f85137c65565a308bbcf4fdcc7d8ebce01267

Detection Methods for CVE-2026-77399

Indicators of Compromise

Inbound .ics files or CalDAV payloads containing VALARM components with unusually large REPEAT values (for example, values exceeding thousands or approaching 32-bit integer maximums).
Python processes using the icalendar package showing sustained high CPU or rapid heap growth after processing calendar data.
Application timeouts, worker crashes, or out-of-memory kills correlated with calendar ingestion endpoints.

Detection Strategies

Inspect uploaded iCalendar content at the application boundary and flag REPEAT: lines exceeding a reasonable threshold before invoking the parser.
Instrument calls to Alarms.times, Alarms.active, and Alarm.triggers with execution time and memory allocation metrics to surface anomalous expansions.
Enable Python resource module limits or container cgroup memory caps on worker processes handling untrusted calendar data.

Monitoring Recommendations

Track the installed version of icalendar across production environments using a software bill of materials (SBOM) tool and alert on versions between 6.1.0 and 7.2.1.
Monitor per-request latency and memory metrics on endpoints that accept text/calendar content, and alert on statistical outliers.
Review web application firewall logs for POST bodies containing VALARM blocks with high-value REPEAT fields.

How to Mitigate CVE-2026-77399

Immediate Actions Required

Upgrade the icalendar package to version 7.2.2 or later across all Python environments that process calendar data.
Audit application code for direct calls to Alarms.times, Alarms.active, and Alarm.triggers and confirm upstream validation of REPEAT values.
Restrict calendar ingestion endpoints to authenticated users and apply request size limits at the reverse proxy or API gateway.

Patch Information

The fix ships in icalendar release v7.2.2. Technical details are documented in GitHub Security Advisory GHSA-qjcq-q7h7-r74v and the corresponding pull request #1571. The patch introduces _clamp_repeat in icalendar.config and applies it during alarm expansion in src/icalendar/alarms.py.

Workarounds

Pre-parse incoming .ics content and reject or normalize any VALARM component whose REPEAT value exceeds an application-defined ceiling.
Avoid calling Alarms.times, Alarms.active, or Alarm.triggers on untrusted calendar objects until the upgrade is deployed.
Isolate calendar processing in short-lived worker processes with strict CPU and memory limits enforced by the operating system or container runtime.

bash

# Upgrade icalendar to the patched release
pip install --upgrade 'icalendar>=7.2.2'

# Verify the installed version
python -c "import icalendar; print(icalendar.__version__)"