idna vulnerability

The IDNA vulnerability tag covers CVE-2024-3651, a denial-of-service flaw in the kjd/idna library caused by quadratic complexity in the idna.encode() routine. This vulnerability is patched upstream in idna version 3.7 and has been mapped to packaged Python runtimes by multiple distributors. Microsoft's advisory names Azure Linux as a product that includes the affected open-source library, but the language is a product-scoped attestation rather than a guarantee that no other Microsoft artifact contains the vulnerable library. Discussions on WindowsForum focus on understanding the scope of the patch, the technical details of the DoS condition, and the implications for Azure Linux and potentially other systems.