CVE-2026-77399: icalendar: Denial of service via unbounded VALARM REPEAT expansion
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fromical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
icalendarto a version that resolves this vulnerability.Fixed in 7.2.2
Event History
Frequently Asked Questions
Which applications are exposed to this denial of service?
Applications using icalendar versions 6.1.0 through 7.2.1 are exposed if they process attacker-controlled calendar data and request alarm times through Alarms.times or Alarms.active. In versions 7.0.0 through 7.2.1, use of Alarm.triggers is also an affected path.
What must an attacker do to trigger the issue?
An attacker needs to supply an iCalendar object containing a VALARM with an attacker-controlled REPEAT value, then cause the application to access an affected alarm-time property. Parsing the calendar data alone does not trigger the excessive expansion.
Are default parsing workflows affected?
No. The issue is not triggered merely by parsing an iCalendar file; it requires code to access Alarms.times, Alarms.active, or, in affected 7.x versions, Alarm.triggers.
What is the mitigation if upgrading cannot happen immediately?
Avoid accessing the affected alarm expansion properties for untrusted calendar data, or enforce an application-level limit on alarm repetitions before requesting alarm times. Upgrade to icalendar 7.2.2 to obtain the fix.