What is the CVSS score of CVE-2026-55247?

CVE-2026-55247 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of plone.app.event are affected by CVE-2026-55247?

A critical denial-of-service vulnerability affecting Plone's event import capability (CVE-2026-55247, CVSS 9.1) enables attackers to remotely disable event functionality in affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55247?

Yes, a public proof-of-concept exploit is available for CVE-2026-55247. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55247?

Within 24 hours: Inventory all Plone deployments using plone.app.event package and document affected versions; restrict event import endpoint access to known, trusted IP sources via firewall rules. Within 7 days: Implement ICS file input validation (format verification, file size limits); configure Web Application Firewall (WAF) rules to block malformed calendar uploads; enable detailed logging of import failures and suspicious submissions. Within 30 days: Monitor Plone security advisories and release channels daily for patch availability; prepare rapid deployment procedures to apply vendor fix within 48 hours of release.

plone.app.event CVE-2026-55247

EUVD-2026-67868 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-06-23

GHSA-r82h-mqw3-fc56

Denial Of Service

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

vuln.today AI

6.5 MEDIUM

iCal import in Plone typically requires an authenticated contributor role; impact is pure availability loss with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Aug 28, 2026 - 21:17 EUVD

CVSS changed

Aug 28, 2026 - 20:22 NVD

9.1 (CRITICAL)

Analysis Generated

Jun 23, 2026 - 20:19 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial-of-service via malformed iCalendar import in Plone's plone.app.event package, rated 9.1 critical, enables remote disruption of affected Plone installations by submitting a crafted ICS file to the event import endpoint. Disclosed June 23, 2026 as part of a coordinated Plone security release addressing six distinct vulnerabilities across multiple packages. No public exploit code or CISA KEV listing has been identified at time of analysis, though the critical severity rating and co-disclosure of a related icalendar library CVE (CVE-2026-55099) the same week warrant prompt patching.

Technical ContextAI

Plone's plone.app.event package provides calendar and event management functionality for the Plone CMS, including the ability to import events from iCalendar (ICS/RFC 5545) formatted files. The vulnerability resides in how this component processes iCalendar input - the DoS-via-import pattern is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-835 (Loop with Unreachable Exit Condition), such as unbounded parsing of pathologically complex recurrence rules, excessive nesting, or extremely large calendar datasets. A closely related upstream advisory (CVE-2026-55099, GHSA-cv84-9p8j-fj68, scored 7.5 high) targets the collective/icalendar Python parsing library used by plone.app.event, suggesting the root cause may originate in the shared dependency. No CWE identifier or CPE strings were provided in the available source data.

RemediationAI

Consult the official vendor advisory at https://github.com/plone/plone.app.event/security/advisories/GHSA-r82h-mqw3-fc56 for the confirmed patched version of plone.app.event. This vulnerability was disclosed June 23, 2026 as part of a coordinated Plone security release, indicating fixes were available at disclosure time; however, no exact patched version number was independently confirmed from the available source data. Also update the collective/icalendar library per CVE-2026-55099 (GHSA-cv84-9p8j-fj68) as the underlying parsing library may share the root cause. If immediate patching is not possible, consider restricting the iCalendar import endpoint to trusted authenticated roles only, or disabling it entirely if not in active use - note that disabling import will break legitimate event synchronization workflows. Review all six CVEs in the June 23, 2026 Plone coordinated release for a complete remediation scope.