The vulnerability resides in the icalendar Python library, which parses and generates iCalendar files. From versions 6.1.0 through 7.2.2, the vInt.from_ical function accepts a VALARM REPEAT property set by an attacker. When application code accesses Alarms.times or Alarms.active, the library eagerly expands the repeat count without an application‑level limit. Alarm.triggers adds a second vulnerable path starting with version 7.0.0. This expansion can consume excessive CPU time and heap memory, eventually terminating or stalling the host process. The flaw is classified under CWE‑400 (Uncontrolled Resource Consumption) and CWE‑834 (Unbounded Recursion).

Affected systems are applications that depend on the collective:icalendar Python package. The vulnerable range spans 6.1.0 to 7.2.2. Functions Alarms.times, Alarms.active, and Alarm.triggers are the exposed entry points. Any code that parses an attacker‑controlled iCalendar file and then queries one of these properties may trigger the resource exhaustion.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting no immediate widespread exploitation. The attack vector is local to applications that load the library; an adversary must supply a crafted iCalendar file and cause the application to request the affected alarm properties. Resource exhaustion can be mitigated by updating the library or limiting repeat values before expansion.