Skip to content
Fencer Intel
medium 6.5

CVE-2026-77399 json

icalendar: Denial of service via unbounded VALARM REPEAT expansion

published 3mo ago modified last mo. also EUVD-2026-84800 , GHSA-qjcq-q7h7-r74v

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository collective/icalendar. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.

Patch / fix

  • pypi icalendar 7.2.2
  • python-icalendar Debian 14 7.3.0-1

debian advisories DEBIAN-CVE-2026-77399

Is CVE-2026-77399 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last mo.

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi icalendar
>=6.1.0
7.2.2

Affected products

  • collective icalendar

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-834 Excessive Iteration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of collective/icalendar published their own advisory on GitHub. Reviewed sources take precedence over it.