CVE-2026-55099: icalendar has Algorithmic Complexity in Equality
Component.__eq__ compares subcomponents in O(2^n) time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (==, !=, in, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service.
References
- github.com/advisories/GHSA-cv84-9p8j-fj68
- github.com/collective/icalendar/commit/b6b2608ae3af6de40695b4e40f71847485aa0b49
- github.com/collective/icalendar/commit/cad40cd112c93fd142ec12cc5b37445a849b8a79
- github.com/collective/icalendar/releases/tag/v7.1.3
- github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68
- nvd.nist.gov/vuln/detail/CVE-2026-55099
Code Behaviors & Features
Detect and mitigate CVE-2026-55099 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →