add rustls-ffi GHSA-rc3f-4j82-cmrg advisory

crates/rustls-ffi/RUSTSEC-0000-0000.md

@@ -0,0 +1,30 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "rustls-ffi"
+date = "2026-10-26"
+url = "https://github.com/rustls/rustls-ffi/releases/tag/v/0.15.7"
+categories = ["memory-corruption"]
+aliases = ["GHSA-rc3f-4j82-cmrg"]
+
+[versions]
+patched = [">= 0.15.7"]
+unaffected = ["< 0.12.0"]
+```
+
+# Use-after-free of caller-owned server name in client connection constructors
+
+In rustls-ffi 0.12.0 through 0.15.6, `rustls_client_connection_new()` and
+`rustls_client_connection_new_alpn()` retained a reference to the caller's
+`server_name` buffer after returning, rather than copying it. The API
+documentation did not require the buffer to outlive the call and as a result
+if the caller freed or reused the buffer, later TLS processing read freed
+memory.
+
+Clients that free or reuse the `server_name` buffer after the constructor
+returns are affected. This is most likely for language bindings that pass
+temporary strings. Callers that keep the `server_name` buffer alive for the
+lifetime of the `rustls_client_config` are not affected.
+
+Versions 0.12.0 through 0.15.6 are affected. Version 0.15.7+ changed these APIs
+to copy the input buffer.