The vulnerability lies in the equality comparison of calendar components within the icalendar library, where nested subcomponents are checked with two nested membership loops. Each membership test recursively invokes the same comparison on child components, leading to exponential growth in computation time relative to the depth of nesting. An attacker can construct a small .ics file containing deeply nested equal subtrees; when an application performs equality, inequality, membership, deduplication, assertion, round-trip, or normalization checks on this data, the side‑channel causes the process to consume a CPU core for a prolonged period or indefinitely, resulting in a denial of service. The flaw does not trigger during initial parsing, only during comparison operations.

This issue affects the collective iCalendar Python library from version 7.1.0 through 7.1.3. Any application that imports or synchronizes iCalendar data using these releases and subsequently performs equality or related comparisons is vulnerable. The fix was released in 7.1.3, so users on earlier versions must upgrade to avoid the attack.

The CVSS score of 7.5 classifies this flaw as a serious risk, with a defined value that reflects the denial‑of‑service impact and the lack of remote control. EPSS is not available, so the current estimate of exploit probability is unclear; however, vulnerabilities of this nature are commonly exploited by automated scripts that inject malicious calendars into mail servers or sync services. The attack vector is inferred to be remote, based on the fact that an adversary can supply a crafted .ics file to any endpoint that performs the affected comparison operations. Since the flaw is not listed in the CISA KEV catalog, it has not yet been evidenced in the wild, but the high severity warrants immediate mitigation.