Pypi · Calendar · CVE-2026-55099
**Name of the Vulnerable Software and Affected Versions**
icalendar versions 7.1.0 through 7.1.2
**Description**
The software contains a flaw in the Component equality method within `src/icalendar/cal/component.py` that leads to exponential time complexity O(2^n) relative to nesting depth when comparing nested subcomponents. Because `Component.from ical` allows arbitrarily nested BEGIN:VEVENT blocks without a depth limit, a small .ics file containing equal nested subtrees can cause a CPU core to be pinned for minutes or indefinitely. This results in a denial of service during equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons, specifically affecting calendar sync or import endpoints and invite processing.
**Recommendations**
Update to version 7.1.3.