icalendar: Denial of service via unbounded VALARM REPEAT expansion
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| collective | icalendar | 6.1.0 to before 7.2.2 | 7.2.2 | Patch available | CNA |
- icalendar Vendorcollective Affected 6.1.0 to before 7.2.2 Fixed in 7.2.2 Patch available CNA
Remediation
- Fix · CNA icalendar (collective) Fixed in 7.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77399
References
Other 5
- https://github.com/collective/icalendar/security/advisories/GHSA-qjcq-q7h7-r74v
- https://github.com/collective/icalendar/pull/1571
- https://github.com/collective/icalendar/commit/157f85137c65565a308bbcf4fdcc7d8ebce01267
- https://github.com/collective/icalendar/commit/cddd37226adbc52cca52a399f61d38a378221219
- https://github.com/collective/icalendar/releases/tag/v7.2.2
More collective vulnerabilities
- TI-2026-39801 icalendar: Algorithmic Complexity in Equality CVSS 3.1HIGH 7.5
- TI-2012-04038 Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows… CVSS 2.0MEDIUM 4.3
- TI-2005-04112 Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to… CVSS 2.0MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences