The icalendar library contains an uncontrolled resource consumption vulnerability that enables remote attackers to cause service instability or crashes.

This is an uncontrolled resource consumption flaw (CWE-400) where the library fails to limit the expansion of VALARM REPEAT values. An authenticated attacker can supply a malicious iCalendar file that causes the application to consume excessive CPU and heap memory upon property access.

Successful exploitation results in a denial of service, where the affected application becomes unresponsive or terminates unexpectedly. Given the CVSS score of 6.5, this medium-severity vulnerability presents a clear risk to service availability, particularly for systems that rely on icalendar for automated scheduling or calendar synchronization.

Immediate Action: Update the collective icalendar library to version 7.2.2 or later to include the necessary input validation limits.

Proactive Monitoring: Monitor server-side logs and system performance metrics for unexpected spikes in CPU or memory usage associated with calendar file processing tasks.

Compensating Controls: Implement strict application-level limits on the size and complexity of imported calendar files to prevent resource exhaustion before the library processes them.

Public Exploit Available: No

Organizations utilizing the icalendar library should prioritize upgrading to version 7.2.2 during the next maintenance cycle. By establishing proper input validation and resource limits, administrators can effectively mitigate the risk of denial of service attacks targeting this parsing component.