AIKIDO-2026-725341

TL;DR

The Component.__eq__ method compares subcomponents with nested membership loops that recurse into each child, so an equality check runs in O(2^n) time relative to component nesting depth. Because the parser imposes no limit on nesting depth, a small crafted .ics file containing deeply nested equal subtrees can make a single comparison run for minutes or hang indefinitely while pinning a CPU core. Any application that compares parsed calendar components with ==, !=, in, set or dict membership, deduplication, or round-trip checks against attacker-supplied data is exposed to an unauthenticated denial of service. The fix rewrites Component.__eq__ to walk an explicit stack, matching each pair of nested components exactly once so equality becomes linear in the number of components.