What is the CVSS score of CVE-2026-55099?

CVE-2026-55099 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of icalendar are affected by CVE-2026-55099?

The collective/icalendar library used by Plone CMS and Python applications contains a denial-of-service vulnerability that can crash or hang services processing calendar files, with no public exploit…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55099?

Yes, a public proof-of-concept exploit is available for CVE-2026-55099. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-55099?

24 hours: Complete inventory of all systems and applications using collective/icalendar library, determine current versions, and identify sources of external iCalendar input. 7 days: Implement input validation with file size limits on iCalendar processing, enable detailed error logging for parse failures, and configure rate limiting on calendar import functions. 30 days: Monitor vendor advisory channels for patch availability and establish expedited deployment procedures for when a fix is released.

icalendar CVE-2026-55099

EUVD-2026-65743 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-23

GHSA-cv84-9p8j-fj68

Denial Of Service Python

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable parser, no authentication or interaction needed; sole impact is availability loss consistent with the stated 7.5 score.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 25, 2026 - 21:04 EUVD

CVSS changed

Aug 25, 2026 - 20:22 NVD

7.5 (HIGH)

Analysis Generated

Jun 23, 2026 - 20:15 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on icalendar (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.1.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of Service in the collective/icalendar Python library allows attackers to crash or hang applications that process externally supplied iCalendar data. The vulnerability carries a CVSS score of 7.5 High and affects Plone CMS deployments as well as any Python application using the library to parse .ics input. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The collective/icalendar library (https://github.com/collective/icalendar) is a Python package implementing RFC 5545 iCalendar format parsing, widely used in Plone CMS and other Python web frameworks to import, export, and process calendar data. The vulnerability resides in the parsing logic itself - likely a resource exhaustion condition (e.g., deeply nested structures, unbounded loops, or memory amplification during parsing) triggered by maliciously crafted .ics content. No CWE was specified in the provided data, but denial-of-service via malicious parsing input is most commonly associated with CWE-400 (Uncontrolled Resource Consumption) or CWE-835 (Loop with Unreachable Exit Condition). The CVSS score of 7.5 High, consistent with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, suggests the parsing path is network-reachable and requires no authentication.

RemediationAI

The primary fix is to upgrade the collective/icalendar library to the patched version specified in the advisory at https://github.com/collective/icalendar/security/advisories/GHSA-cv84-9p8j-fj68 - the exact fix version was not confirmed in the provided input data and should be verified there directly before deploying. As a compensating control while patching, administrators should restrict access to iCalendar import endpoints to authenticated and trusted users only, or temporarily disable iCalendar import functionality if the application supports it. Rate-limiting or payload size limits on .ics file uploads can reduce but may not fully eliminate the risk of resource exhaustion. Plone site administrators should also review the related plone.app.event advisory (CVE-2026-55247, GHSA-r82h-mqw3-fc56, severity 9.1 Critical) as it describes a closely related iCalendar import DoS with a higher severity rating that may share the same underlying code path.