PT-2026-81994 · Pypi · Calendar

Publicado

2026-08-25

·

Atualizado

2026-08-25

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Component. eq compares subcomponents in O(2^n) time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (==, !=, in, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.

Details

Component subclasses dict and stores children in a separate subcomponents list. eq (src/icalendar/cal/component.py:642-665) checks set-equivalence of children with two membership loops:
python
def  eq (self, other):
  if len(self.subcomponents) != len(other.subcomponents):
    return False
  if not super(). eq (other):
    return False
  for subcomponent in self.subcomponents:
    if subcomponent not in other.subcomponents:
      return False
  for subcomponent in other.subcomponents:
    if subcomponent not in self.subcomponents:
      return False
  return True
Each ... not in ... test invokes eq on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: T(n) = 2·T(n-1) → O(2^n).
Parsing does not gate this. Component.from ical builds the structure iteratively and imposes no depth limit, so BEGIN:VEVENT blocks can be nested to any depth (parsing the payload below is instant). The cost is paid only when a comparison occurs, and only when the operands are equal far enough down to keep both loops recursing, a condition the attacker controls by submitting equal subtrees.

PoC

python
from icalendar import Calendar

d = 26
event = b"BEGIN:VEVENTr
" * d + b"END:VEVENTr
" * d
ics = b"BEGIN:VCALENDARr
" + event + event + b"END:VCALENDARr
"

cal = Calendar.from ical(ics)
a, b = cal.subcomponents
a == b
Measured on icalendar 7.1.x, CPython 3.14:
PayloadDepth== time
552 B200.76 s
656 B2412 s
708 B2648 s
~800 B30~13 min
A single uploaded file supplies both operands (two identical nested events), so no second input is needed. The same blowup occurs in round-trip checks (cal == Calendar.from ical(cal.to ical())) and in any membership/dedup logic over subcomponents.

Impact

Algorithmic-complexity denial of service (CWE-407). Unauthenticated; a few hundred bytes of input pin a CPU core indefinitely. It affects any service that parses untrusted iCalendar data and then compares components for equality or membership, including calendar sync/import endpoints, invite processing, dedup, and round-trip/normalization checks. It is not triggered by parsing alone, and a comparison against an early-differing object short-circuits harmlessly, so impact is limited to code paths that perform such comparisons.

Fix

Component. eq rewritten to walk an explicit stack instead of recursing, matching each pair of nested components exactly once. Equality is now linear in the number of components and preserves the existing multiset equivalence and commutativity semantics.

Correção

Resource Exhaustion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-400CWE-407

Identificadores relacionados

GHSA-CV84-9P8J-FJ68

Produtos afetados

Calendar