https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:27:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55099 <p><strong>Affected:</strong> collective icalendar</p> <p>icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.</p> <p><strong>Affected:</strong> collective icalendar</p> <p>icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-55099 https://vulnerability.circl.lu/vuln/ghsa-cv84-9p8j-fj68 <p><strong>Affected:</strong> PyPI: icalendar</p> <p>### Summary</p> <p>`Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte `.ics` file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (`==`, `!=`, `in`, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.</p> <p>### Details</p> <p>`Component` subclasses `dict` and stores children in a separate `subcomponents` list. `__eq__` (`src/icalendar/cal/component.py:642-665`) checks set-equivalence of children with two membership loops:</p> <p>```python def __eq__(self, other): if len(self.subcomponents) != len(other.subcomponents): return False if not super().__eq__(other): return False for subcomponent in self.subcomponents: if subcomponent not in other.subcomponents: return False for subcomponent in other.subcomponents: if subcomponent not in self.subcomponents: return False return True ```</p> <p>Each `... not in ...` test invokes `__eq__` on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: `T(n) = 2·T(n-1)` → `O(2^n)`.</p> <p>Parsing does not gate this. `Component.from_ical` builds the structure iteratively and imposes no depth limit, so `BEGIN:VEVENT` blocks can be nested to any depth (parsing the payload below is ins…</p> <p><strong>Affected:</strong> PyPI: icalendar</p> <p>### Summary</p> <p>`Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte `.ics` file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (`==`, `!=`, `in`, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.</p> <p>### Details</p> <p>`Component` subclasses `dict` and stores children in a separate `subcomponents` list. `__eq__` (`src/icalendar/cal/component.py:642-665`) checks set-equivalence of children with two membership loops:</p> <p>```python def __eq__(self, other): if len(self.subcomponents) != len(other.subcomponents): return False if not super().__eq__(other): return False for subcomponent in self.subcomponents: if subcomponent not in other.subcomponents: return False for subcomponent in other.subcomponents: if subcomponent not in self.subcomponents: return False return True ```</p> <p>Each `... not in ...` test invokes `__eq__` on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: `T(n) = 2·T(n-1)` → `O(2^n)`.</p> <p>Parsing does not gate this. `Component.from_ical` builds the structure iteratively and imposes no depth limit, so `BEGIN:VEVENT` blocks can be nested to any depth (parsing the payload below is ins…</p> https://vulnerability.circl.lu/vuln/ghsa-cv84-9p8j-fj68