icalendar 7.1.3 security vulnerability patched #1464

stevepiercy · 2026-06-16T08:07:11Z

stevepiercy
Jun 16, 2026
Maintainer

icalendar 7.1.3 security vulnerability patched

The icalendar team is pleased to announce that icalendar 7.1.3 has been released. This is a security patch release that fixes a vulnerability that was introduced in icalendar 7.1.0. It's recommended to upgrade icalendar versions 7.1.0 - 7.1.2 to 7.1.3.

Plone 6.2.0 is affected by this vulnerability. Plone 6.1.x is not affected because it uses icalendar 6.3.2, which is not affected.

Thanks to @tidusec on GitHub for the responsible report and the initial pull request, with additional guidance and help to improve regression testing by @mauritsvanrees from the @plone Security Team. Thanks to the @nlnet Foundation and its financial support from its NGI Zero Core grant program which helped create a responsive community around crucial free and open source software. This was the icalendar team's first security response, and it wouldn't have happened without this collaboration and support.

A CVE has been requested. A link to it will be published when it's available.

For the complete change log, visit:
https://icalendar.readthedocs.io/en/stable/reference/changelog.html

Summary

Component.__eq__ compares subcomponents in O(2^n) time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (==, !=, in, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.

Details

Component subclasses dict and stores children in a separate subcomponents list. __eq__ (src/icalendar/cal/component.py:642-665) checks set-equivalence of children with two membership loops:

def __eq__(self, other):
    if len(self.subcomponents) != len(other.subcomponents):
        return False
    if not super().__eq__(other):
        return False
    for subcomponent in self.subcomponents:
        if subcomponent not in other.subcomponents:
            return False
    for subcomponent in other.subcomponents:
        if subcomponent not in self.subcomponents:
            return False
    return True

Each ... not in ... test invokes __eq__ on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: T(n) = 2·T(n-1) → O(2^n).

Parsing does not gate this. Component.from_ical builds the structure iteratively and imposes no depth limit, so BEGIN:VEVENT blocks can be nested to any depth (parsing the payload below is instant). The cost is paid only when a comparison occurs, and only when the operands are equal far enough down to keep both loops recursing, a condition the attacker controls by submitting equal subtrees.

PoC

from icalendar import Calendar

d = 26
event = b"BEGIN:VEVENT\r\n" * d + b"END:VEVENT\r\n" * d
ics = b"BEGIN:VCALENDAR\r\n" + event + event + b"END:VCALENDAR\r\n"

cal = Calendar.from_ical(ics)
a, b = cal.subcomponents
a == b

Measured on icalendar 7.1.x, CPython 3.14:

Payload	Depth	`==` time
552 B	20	0.76 s
656 B	24	12 s
708 B	26	48 s
~800 B	30	~13 min

A single uploaded file supplies both operands (two identical nested events), so no second input is needed. The same blowup occurs in round-trip checks (cal == Calendar.from_ical(cal.to_ical())) and in any membership/dedup logic over subcomponents.

Impact

Algorithmic-complexity denial of service (CWE-407). Unauthenticated; a few hundred bytes of input pin a CPU core indefinitely. It affects any service that parses untrusted iCalendar data and then compares components for equality or membership, including calendar sync/import endpoints, invite processing, dedup, and round-trip/normalization checks. It is not triggered by parsing alone, and a comparison against an early-differing object short-circuits harmlessly, so impact is limited to code paths that perform such comparisons.

Fix

Component.__eq__ rewritten to walk an explicit stack instead of recursing, matching each pair of nested components exactly once. Equality is now linear in the number of components and preserves the existing multiset equivalence and commutativity semantics.

Bug fixes

Comparing components with Component.__eq__ is no longer exponential in the subcomponent nesting depth, removing a denial-of-service vector where a deeply nested component could take minutes to compare. See GHSA-cv84-9p8j-fj68 at GHSA-cv84-9p8j-fj68. @tidusec

Support icalendar

This release was made possible through a NGI Zero Core grant from the NLNet Foundation as part of a larger project to develop the Open Web Calendar stack.
https://nlnet.nl/project/OpenWebCalendar-recurring/

Funding development helps create a responsive community around the Python calendaring ecosystem.
https://pycal.org/

As free and open source software, icalendar thrives and grows only when it receives support from you. You can help icalendar keep up-to-date with your platform and continue to use it in your applications in many ways.

Make a one-time or recurring financial contribution through OpenCollective at https://opencollective.com/python-icalendar.
Report security issues per https://github.com/collective/icalendar/blob/main/SECURITY.md.
Report all other issues in the issue tracker.
Comment on and resolve issues.
Submit pull requests from your fork of the icalendar repository.
Extend the documentation.

Join the icalendar community

The maintainer of icalendar, Nicco Kunzmann (GitHub: @niccokunzmann), gratefully appreciates the contributions for this release. See the list of contributors.

https://github.com/collective/icalendar/graphs/contributors

By fostering a warm and welcoming community around free and open source software, icalendar attracts both experienced and first-time contributors to participate. See how to contribute.

https://icalendar.readthedocs.io/en/stable/contribute/index.html