CVE-2026-55099: Algorithmic Complexity Denial of Service in icalendar Component Equality
Vulnerability ID: CVE-2026-55099
CVSS Score: 7.5
Published: 2026-08-25
An algorithmic complexity denial of service vulnerability exists in the Python icalendar library's component equality evaluation. Due to recursive nested comparisons inside list membership operations, parsing and validating calendar components with deep nesting triggers exponential execution time, blocking application threads and consuming 100% of the available CPU core.
TL;DR
An exponential time complexity issue in icalendar's comparison logic allows unauthenticated remote attackers to cause Denial of Service by submitting deeply nested, lightweight calendar payloads.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-407
- Attack Vector: Network
- Complexity: Low
- CVSS v3.1 Score: 7.5 (High)
- Impact: Denial of Service (Thread Exhaustion)
- Exploit Status: PoC Available
Affected Systems
- icalendar (Python library)
-
icalendar: >= 7.1.0, < 7.1.3 (Fixed in:
7.1.3)
Code Analysis
Commit: b6b2608
Initial core fix implemented by Timothy Dudley to eliminate the O(2^d) complexity curve.
Commit: cad40cd
Code cleanup and comments refactored, introducing the specialized helper structure _ComponentEqFrame.
Mitigation Strategies
- Upgrade to icalendar version 7.1.3 or higher
- Implement strict validation of input nesting depth prior to parsing
Remediation Steps:
- Update pip environments using pip install --upgrade icalendar
- Add pre-parser checks to block deeply nested VEVENT elements
- Restart calendar synchronizers to apply changes
References
Read the full report for CVE-2026-55099 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)