CVE-2026-55099

Name of the Vulnerable Software and Affected Versions icalendar versions 7.1.0 through 7.1.2

Description The software contains a flaw in the Component equality method within src/icalendar/cal/component.py that leads to exponential time complexity O(2^n) relative to nesting depth when comparing nested subcomponents. Because Component.from ical allows arbitrarily nested BEGIN:VEVENT blocks without a depth limit, a small .ics file containing equal nested subtrees can cause a CPU core to be pinned for minutes or indefinitely. This results in a denial of service during equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons, specifically affecting calendar sync or import endpoints and invite processing.

Recommendations Update to version 7.1.3.