Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-77399icalendar: Denial of service via unbounded VALARM REPEAT expansion

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in icalendar from collective. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14python-icalendar7.3.0-1DEBIAN-CVE-2026-77399
Ubuntu:22.04:LTSpython-icalendarno fix listedUBUNTU-CVE-2026-77399
Ubuntu:24.04:LTSpython-icalendarno fix listedUBUNTU-CVE-2026-77399
Ubuntu:26.04:LTSpython-icalendarno fix listedUBUNTU-CVE-2026-77399
Ubuntu:26.10python-icalendarno fix listedUBUNTU-CVE-2026-77399

Affected products (as reported)

VendorProductVersions
collective icalendar >= 6.1.0, < 7.2.2

Weakness: CWE-400, CWE-834 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References