AIKIDO-2026-800557
icalendar is vulnerable to Uncontrolled Resource Consumption
65
Medium Risk
This Affects:
icalendarTL;DR
The REPEAT property of a VALARM component controls how many additional times an alarm fires, and vInt parses it as a plain integer with no RFC 5545 ceiling. When alarm times are computed through Alarm.triggers or the Alarms helper, both code paths eagerly expand every repetition into an in-memory list with no bound. A crafted calendar with a very large REPEAT value forces huge list allocations that exhaust CPU and memory when untrusted calendar data is processed. The fix caps expansion at icalendar.config.MAX_ALARM_REPEAT and enforces the RFC 5545 signed 32-bit integer range when parsing integers.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application computes alarm times from untrusted calendar data.
Background info
icalendar is vulnerable to Uncontrolled Resource Consumption in versions 6.1.0 - 7.2.0.
How to fix this
Upgrade the icalendar library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant