CVE-2026-55099: CWE-400: Uncontrolled Resource Consumption in collective icalendar

The collective icalendar library (RFC 5545 compatible) versions 7.1.0 through 7.1.2 have an uncontrolled resource consumption vulnerability (CWE-400) due to the Component equality method in src/icalendar/cal/component.py. This method performs nested membership loops that invoke equality checks recursively on child components, resulting in O(2^n) complexity relative to nesting depth. An attacker can craft a small .ics file with deeply nested and equal subtrees that triggers this exponential cost during equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue; it requires these comparison operations. The vulnerability can cause denial of service by consuming CPU resources extensively. The issue is resolved in version 7.1.3.

An attacker can cause a denial of service by submitting a crafted iCalendar (.ics) file with deeply nested BEGIN:VEVENT blocks that trigger exponential CPU consumption during component comparison operations. This can pin a CPU core for minutes or indefinitely, disrupting calendar synchronization, import endpoints, invite processing, and other operations relying on component comparisons. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

Upgrade to collective icalendar version 7.1.3 or later, where this vulnerability is fixed. Until then, avoid processing untrusted .ics files that may contain deeply nested components. No other official remediation or temporary fix is documented. Patch status is not explicitly confirmed beyond the fix in 7.1.3; check vendor advisories for updates.