Add RUSTSEC for lz4_flex (CVE-2026-32829)

Author: PSeitz

crates/lz4_flex/RUSTSEC-0000-0000.md

@@ -0,0 +1,43 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "lz4_flex"
+date = "2026-03-17"
+categories = ["memory-exposure"]
+keywords = ["lz4", "decompression", "information-disclosure", "uninitialized-memory"]
+aliases = ["CVE-2026-32829", "GHSA-vvp9-7p8x-rfvv"]
+cvss = "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+
+[affected.functions]
+"lz4_flex::block::decompress_into" = ["<= 0.11.5", "= 0.12.0"]
+"lz4_flex::block::decompress_into_with_dict" = ["<= 0.11.5", "= 0.12.0"]
+
+[versions]
+patched = [">= 0.11.6, < 0.12.0", ">= 0.12.1"]
+```
+
+# Decompressing invalid data can leak information from uninitialized memory or reused output buffer
+
+Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory,
+or leak content from previous decompression operations when reusing an output buffer.
+
+The LZ4 block format defines a "match copy operation" which duplicates previously written
+data or data from a user-supplied dict. The position of that data is defined by an _offset_.
+`lz4_flex` did not properly validate _offset_ values, causing it to copy data from outside
+the initialized portion of the output buffer.
+
+Two scenarios are affected:
+
+- Decompressing with the `unsafe` implementation (`safe-decode` feature flag disabled, which
+  is the default): can leak content of uninitialized memory as part of the decompressed result.
+- Decompressing into a reused, user-supplied output buffer (also affects `safe-decode`): can
+  leak the previous contents of the output buffer as part of the decompressed result.
+
+Only the block-based API is affected: `lz4_flex::block::decompress_into` and
+`lz4_flex::block::decompress_into_with_dict`. All frame APIs are unaffected.
+
+The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values
+during decompression.
+
+If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
+each call to the affected functions and enabling the `safe-decode` feature flag.