AIKIDO-2026-129315

TL;DR

Icalendar::Calendar.parse recurses once for every BEGIN: line in an .ics input with no limit on nesting depth. A calendar with a few thousand nested components exhausts the Ruby call stack and raises SystemStackError, which does not inherit from StandardError so a caller's rescue => e around the parse does not catch it and the request aborts. This affects applications that hand untrusted calendar data (uploaded invites, subscribed feeds, mail attachments) to the parser without their own size or nesting limit. The fix tracks nesting depth in parse_component and raises a normal ParseError once a configurable depth limit (default 5) is exceeded.