CVE-2026-125327
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
75/100
Published: 2026-11-10
Modified: 2026-11-12
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Weakness Classification (2)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| pgEdge | pgedge-rag-server | < 2.0.0 |
| pgEdge | pgedge-rag-server | < 2.0.0 |
References & Advisories (4)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM