Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55099— icalendar: Algorithmic Complexity in Equality

Quick assessment

Affected
collective icalendar
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

icalendar 是一个兼容 RFC 5545 标准的 Python 库，用于解析和生成 iCalendar 文件。在版本 7.1.0 至 7.1.3 中， 文件中的 相等性比较方法通过两个嵌套的成员资格检查循环来比较子组件；每个成员资格测试都会在其子组件上递归调用相同的方法，导致计算复杂度随嵌套深度呈指数级增长（即 O(2^n)）。 方法允许任意深度的嵌套 块，且没有设置深度限制。因此，攻击者可以提交一个小于 1KB 的 .ics 文件，其中包含相等的嵌套子树结构。当应用程序执行相等性、不等性、成员资格判断、去

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
collective icalendar >= 7.1.0, < 7.1.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55099

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
icalendar: Algorithmic Complexity in Equality
Source: CVE Program / CVE List V5
Vulnerability Description
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
collective icalendar >= 7.1.0, < 7.1.3 -

II. Public POCs for CVE-2026-55099

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 8708 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55099

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55099 (3)

Vendor Advisories for CVE-2026-55099 (1)

IV. Related Vulnerabilities

Same product: icalendar
Same weakness: CWE-400

V. Comments for CVE-2026-55099

No comments yet

Leave a comment