Hi,

The following vulnerability was published for python-icalendar.

CVE-2026-77399[0]:
| icalendar is an RFC 5545 compatible parser and generator of
| iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical
| accepts an attacker-controlled VALARM REPEAT value and applications
| that request alarm times can eagerly expand it without an
| application-level limit. Alarms.times and Alarms.active reach the
| unbounded expansion in versions starting with 6.1.0, while
| Alarm.triggers adds a second affected path starting with 7.0.0.
| Parsing alone does not trigger the issue, but accessing these
| properties can consume excessive CPU time and heap memory and
| terminate or stall a service. This issue is fixed in version 7.2.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-77399
https://www.cve.org/CVERecord?id=CVE-2026-77399
[1] https://github.com/collective/icalendar/security/advisories/GHSA-qjcq-q7h7-r74v
[2] https://github.com/collective/icalendar/commit/157f85137c65565a308bbcf4fdcc7d8ebce01267

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
python-icalendar, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148817@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated python-icalendar package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 30 Sep 2026 12:38:55 +0200
Source: python-icalendar
Architecture: source
Version: 7.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1145541 1148817
Changes:
 python-icalendar (7.3.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 7.3.0 (Closes: #1145541)
     * CVE-2026-77399 DOS prevention (Closes: #1148817)
   * Salsa CI: test nocheck & nodoc profiles
   * Add build-dep on python3-sphinx-{design,issues,notfound-page,reredirects}
   * Refresh patches
   * Disable two unpackaged sphinx extenstions
Checksums-Sha1:
 f02635a97888b5be41a4bb47bc917beeff2dff98 2844 python-icalendar_7.3.0-1.dsc
 04e225334331af97e59de222113f29dc84735872 591419 python-icalendar_7.3.0.orig.tar.gz
 fa492f78c1e71eb8058e679f76c5354f7dee1982 9116 python-icalendar_7.3.0-1.debian.tar.xz
 a5f5763be4214cbff1459561cdc10241ee6d4a76 6707 python-icalendar_7.3.0-1_source.buildinfo
Checksums-Sha256:
 ca7b0d30995492eb4bf7b593358ab1f169c13ea7b2aa959a9f2ab90a0f8567c8 2844 python-icalendar_7.3.0-1.dsc
 635969a9df706befb735197b4c6c9979c856347424c625c44ae87a88a6edf3c8 591419 python-icalendar_7.3.0.orig.tar.gz
 c5cb49003bbd8e0338f40994669953245709b463791428d158bc622f12d966a5 9116 python-icalendar_7.3.0-1.debian.tar.xz
 b20b24c7d5affa2bec33ebf98ed3d90c829050cd085a89304a091ab50ebf9b9e 6707 python-icalendar_7.3.0-1_source.buildinfo
Files:
 73616c22e8a07c450e12bea54bbb88c5 2844 python optional python-icalendar_7.3.0-1.dsc
 b73ce41c213a44edd384a29a860367d4 591419 python optional python-icalendar_7.3.0.orig.tar.gz
 d100346ea9a3e5e0e6abece0e5373d87 9116 python optional python-icalendar_7.3.0-1.debian.tar.xz
 93bfefa86d0b35d80b23f407954dc9a1 6707 python optional python-icalendar_7.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmq87XMRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBoPBw/+LeBhgYwiWQjNFS2UV/UTGvXe5TyIDSZr
zq/o9Yvii9fkeenyzq9ULi9OTngHkSWj0yxz619U4YFaRO0WKLWbzsoFxjyyu+Rz
b+s7YKJyuwAn/C7Zc1zi8t+3E3uSHHFRlDIwxcCTbX729gFmZYN8gPAHzaJmKXvn
D4rscDDjKK4fjiXla1ZDUrIV4eZOMX19m6E4mna+lc3EEDHbK1NfFXYmcr1Qa9kv
bzhYkF9cE1DTekpb0LeX1lzzZo7QEd2Djfc2ZfwblgCYOSzPTa/ozH5KmDmjO13+
ST99qOdJhbHYTXRn32d3+XyswpoOLYKi0vA1HSxV6Dk7mMjPrLJZ3tc5q4rFzf/x
5VspHO2TIHf0Dc9JHT13CSaFQHiM+bRrLypvkE83W55yd/SujalBWkJYmmSLq4/Y
Q9ySxP2nE+zWVvAxyEdfVMOrFgxlhVV6SzWuYBxDO46M7CciO64WGrajC/88xeqO
V/UKE5h6bVOfOJXRnGHAPUSOHzhwlfexjJs7pjigqcP0TW/qPye8m/5qDmpUW5XY
RWIS6ybkMh4atJ90MQzV5aiB89mIFwKZ5ktE6xBoMJfmrmtaH9VrEea2hAiUpFRf
cNaN3yTIHsFwMLOQrTZ+rPJiqf2R5rP+gpob/TsQaC+K6AdWAjgxh1w4JVwhtCpi
UhZY+ec3UDs=
=gajg
-----END PGP SIGNATURE-----