NIXPKGS-2026-2745

GitHub issue published 2 days, 11 hours ago

icalendar: Denial of service via unbounded VALARM REPEAT expansion

Permalink CVE-2026-77399

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 days, 11 hours ago by @erictapen Activity log

Created suggestion 3 days, 20 hours ago
@erictapen ignored
5 packages
- haskellPackages.iCalendar
- python314Packages.icalendar-compatibility
- python313Packages.icalendar-compatibility
- python313Packages.icalendar-searcher
- python314Packages.icalendar-searcher
2 days, 11 hours ago
@erictapen accepted 2 days, 11 hours ago
@erictapen published on GitHub 2 days, 11 hours ago

icalendar: Denial of service via unbounded VALARM REPEAT expansion

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.