Some CalDAV clients upload recurring events whose master VEVENT repeats the same RRULE many times, and whose master and RECURRENCE-ID overrides repeat byte-identical VALARMs. SOGo stores these objects as received and returns them through CalDAV to every other client, so one faulty client spreads the damage to every device that syncs the calendar.

Seen on a production server (mailcow, SOGo 5.12.11), across 14 mailboxes:

• one VEVENT with 298 identical lines RRULE:FREQ=WEEKLY;INTERVAL=2;BYDAY=WE
• one object with 1185 identical VALARMs (631 KB)

Effect on other clients: Thunderbird shows the same reminder many times and cannot display the recurrence ("Repeat details unknown"); Android Etar can join the repeated RRULEs into one rule and crash while parsing the event.

The duplicates come from a Thunderbird bug that appends one RRULE/VALARM copy per offline edit playback (https://bugzilla.mozilla.org/show_bug.cgi?id=1713625, fixed for Thunderbird 155, not in 140 ESR; also https://bugzilla.mozilla.org/show_bug.cgi?id=1999085). SOGo does not create them, but it keeps redistributing them after the client is fixed.

RFC 5545 section 3.8.5.3 says RRULE SHOULD NOT occur more than once, and the recurrence set from multiple RRULEs is undefined. Multiple VALARMs are legal (section 3.6.1), so only alarms that serialize identically are duplicates. Distinct alarms must be kept (see 0004600).