Add advisory for pulldown-cmark: Exponential event growth with ENABLE_WIKILINKS

crates/pulldown-cmark/RUSTSEC-0000-0000.md

@@ -0,0 +1,34 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "pulldown-cmark"
+date = "2026-10-18"
+url = "https://github.com/pulldown-cmark/pulldown-cmark/issues/1179"
+references = ["https://github.com/pulldown-cmark/pulldown-cmark/pull/1102"]
+categories = ["denial-of-service"]
+keywords = ["markdown", "wikilinks", "memory-exhaustion"]
+cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+
+[versions]
+patched = [">= 0.13.5"]
+unaffected = ["< 0.13.0"]
+```
+
+# Exponential event growth with `ENABLE_WIKILINKS`
+
+When `Options::ENABLE_WIKILINKS` is enabled, a wikilink with a pipe separator
+and empty display text, such as `[[a|]]`, leaks its child node's sibling chain
+into the content that follows it. Each such link roughly doubles the number of
+events the parser yields for the rest of the document, so output grows
+exponentially with input size: 16 repetitions of `[[a|]] ` (112 bytes) yield
+327,676 events, where the fixed parser yields 65. A document of a few kilobytes
+is enough to exhaust memory in a process that collects the events or renders
+them to HTML.
+
+Applications that parse untrusted Markdown with `ENABLE_WIKILINKS` set,
+including through `Options::all()`, are affected. The option is off by default.
+Parsing without it is not affected.
+
+The flaw was fixed in
+[#1102](https://github.com/pulldown-cmark/pulldown-cmark/pull/1102) and
+released in 0.13.5.