Add advisory for libcrux-ecdh

Author: jschneider-bensch

crates/libcrux-ecdh/RUSTSEC-0000-0000.md

@@ -0,0 +1,25 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "libcrux-ecdh"
+date = "2026-01-26"
+aliases = ["GHSA-435g-fcv3-8j26"]
+url = "https://github.com/cryspen/libcrux/pull/1301"
+cvss = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"
+
+[affected.functions]
+"libcrux_ecdh::validate_scalar" = [ "<= 0.0.5" ]
+
+[versions]
+patched = [">= 0.0.6"]
+```
+
+# X25519 secret validation did not check buffer length or clamping
+
+The latest releases of the libcrux-ecdh crate contains the following
+bug-fix:
+
+[#1301](https://github.com/cryspen/libcrux/pull/1301): Check length
+and clamping in X25519 secret validation. This is a breaking change
+since errors are now raised on unclamped X25519 secrets or inputs of
+the wrong length