EUVD-2026-121709Published
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-125327 · CVE overview and exploitation status
cve-program · CVE-2026-125327
- https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5
- https://github.com/pgEdge/pgedge-rag-server/pull/44
- https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84
- https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
euvd · EUVD-2026-121709
- https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5
- https://github.com/pgEdge/pgedge-rag-server/pull/44
- https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84
- https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
nvd · CVE-2026-125327
- https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84
- https://github.com/pgEdge/pgedge-rag-server/pull/44
- https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
- https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5
osv · GHSA-5qg5-rgp6-j5m5
- https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5
- https://nvd.nist.gov/vuln/detail/CVE-2026-125327
- https://github.com/pgEdge/pgedge-rag-server/pull/44
- https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84
- https://github.com/pgEdge/pgedge-rag-server
- https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
Related changes
Linked by CVE identifier- pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered … · Advisory content revised · 14 Nov 2026
- pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered … · Advisory content revised · 14 Nov 2026
- pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests · Newly collected advisory · 12 Nov 2026
- pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests · Newly collected advisory · 10 Nov 2026