Add advisory for hpke-rs

Author: jschneider-bensch

crates/hpke-rs/RUSTSEC-0000-0000.2.md

@@ -0,0 +1,30 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "hpke-rs"
+date = "2026-02-11"
+aliases = ["GHSA-g433-pq76-6cmf"]
+url = "https://github.com/cryspen/hpke-rs/pull/128"
+
+[affected.functions]
+"hpke_rs::Context::export" = [ "<= 0.5.0" ]
+
+[versions]
+patched = [">= 0.6.0"]
+```
+
+# Incorrect Length Encoding on KDF Export
+
+Passing values `length > 65535` to `Context::export` produces output
+that disagrees with the RFC 9180 label encoding. In particular the
+length value is cast to `u16` truncating any value exceeding
+65535.
+
+## Impact
+Applications that use hpke-rs to export very large secrets would
+experience interoperability issues with other applications that use a
+correct implementation to export very large secrets.
+
+## Mitigation
+Starting with version `0.6.0`, an error will be returned when
+attempting to call `Context::export` with an output length > 65535.