CVE-2026-55099 affects the Python icalendar library versions 7.1.0 through 7.1.2, where the Component equality method performs O(2^n) recursive comparisons on nested subcomponents. An attacker can craft a sub-kilobyte .ics file with deeply nested BEGIN:VEVENT blocks to trigger exponential CPU consumption. The vulnerability is exploited when applications perform equality, inequality, membership, deduplication, or normalization comparisons on parsed calendar data. Affected endpoints include calendar sync, import, invite processing, and any comparison paths. Parsing alone does not trigger the issue, but equal nested subtrees cause worst-case behavior. A few hundred bytes are sufficient to pin a CPU core for minutes or indefinitely, resulting in denial of service. The issue has been patched in icalendar version 7.1.3.
