CVE-2026-55099

### Summary `Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte `.ics` file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components (`==`, `!=`, `in`, set/dict membership, deduplication, test assertions) against attacker-supplied calendar data is exposed to denial of service. ### Details `Component` subclasses `dict` and stores children in a separate `subcomponents` list. `__eq__` (`src/icalendar/cal/component.py:642-665`) checks set-equivalence of children with two membership loops: ```python def __eq__(self, other): if len(self.subcomponents) != len(other.subcomponents): return False if not super().__eq__(other): return False for subcomponent in self.subcomponents: if subcomponent not in other.subcomponents: return False for subcomponent in other.subcomponents: if subcomponent not in self.subcomponents: return False return True ``` Each `... not in ...` test invokes `__eq__` on the children. For a nested chain, both loops descend the full subtree, so each level spawns two recursive comparisons: `T(n) = 2·T(n-1)` → `O(2^n)`. Parsing does not gate this. `Component.from_ical` builds the structure iteratively and imposes no depth limit, so `BEGIN:VEVENT` blocks can be nested to any depth (parsing the payload below is instant). The cost is paid only when a comparison occurs, and only when the operands are equal far enough down to keep both loops recursing, a condition the attacker controls by submitting equal subtrees. ### PoC ```python from icalendar import Calendar d = 26 event = b"BEGIN:VEVENT\r\n" * d + b"END:VEVENT\r\n" * d ics = b"BEGIN:VCALENDAR\r\n" + event + event + b"END:VCALENDAR\r\n" cal = Calendar.from_ical(ics) a, b = cal.subcomponents a == b ``` Measured on `icalendar` 7.1.x, CPython 3.14: |