{"id":"CVE-2026-77399","title":"icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python","summary":"icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expan…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-834"],"vendor":"collective","product":"icalendar","affected":["icalendar >= 6.1.0, < 7.2.2"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:12:04.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77399","references":[{"url":"https://github.com/collective/icalendar/commit/157f85137c65565a308bbcf4fdcc7d8ebce01267","label":"security-advisories@github.com"},{"url":"https://github.com/collective/icalendar/commit/cddd37226adbc52cca52a399f61d38a378221219","label":"security-advisories@github.com"},{"url":"https://github.com/collective/icalendar/pull/1571","label":"security-advisories@github.com"},{"url":"https://github.com/collective/icalendar/releases/tag/v7.2.2","label":"security-advisories@github.com"},{"url":"https://github.com/collective/icalendar/security/advisories/GHSA-qjcq-q7h7-r74v","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"epss":0.00312,"epssPercentile":0.21365,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-23T14:10:14.416349Z"},"ingestedAt":"2026-09-22T20:10:15.089Z","slug":"CVE-2026-77399","body":"## Overview\n\nicalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}