pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
cve-program · CVE-2026-125327
PublishedpgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Read the publisher's advisoryeuvd · EUVD-2026-121709
PublishedpgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Read the publisher's advisorynvd · CVE-2026-125327
PublishedpgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Read the publisher's advisoryosv · GHSA-5qg5-rgp6-j5m5
Published### Impact An unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests. The keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which makes this a materially more effective denial-of-service lever than flooding the endpoint with ordinary requests. The amplification factor grows with corpus size, so the largest deployments are the most exposed. Hybrid search was enabled by default and configured per pipeline rather than per request, so a caller could not opt out of the keyword arm and an operator could not leave it available to some requests but not others. **Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint is reachable by an untrusted party. The endpoint required no authentication and applied no rate limiting. In `1.0.0`, `internal/database/search.go:130` built the corpus query with no `LIMIT`: ```go query = fmt.Sprintf(` SELECT ... FROM %s%s`, tableIdent, filterClause) ``` `FetchDocuments` accepted no limit parameter at all, so neither a caller nor the orchestrator had any way to bound the read. `internal/config/loader.go:197` defaulted `HybridEnabled` to true, and `internal/server/middleware.go:37` applied only logging, panic recovery and optional CORS. ### Patches **Fixed in `2.0.0`. Upgrade to `2.0.0` or later.** Reads are capped by a new per-pipeline `search.bm25_max_documents`, defaulting to 10000, plumbed through `SearchBackend.FetchDocuments` and applied as a parameterised `LIMIT`. There is deliberately no unlimited value: a non-positive setting is rejected at configuration load time rather than silently treated as unbounded. Requests that reach the cap are logged, because keyword recall is partial at that point and an operator should not have to infer it. A new `disable_hybrid` request field lets a caller skip the expensive arm per query, and can only ever turn it off. **After upgrading, review the default `search.bm25_max_documents` value of 10000 against the size of your corpus.** A cap far below corpus size silently reduces keyword recall. ### Workarounds Place the server behind an authenticating, rate-limiting reverse proxy. Setting `hybrid_enabled: false` on each pipeline removes the keyword arm and with it the unbounded read, at the cost of keyword recall. This is the only mitigation available without a proxy. Neither is a substitute for upgrading.
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-125327
PublishedpgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
- Source published
- 10 Nov 2026 18:02:58 UTC
- Source modified
- 12 Nov 2026 18:02:40 UTC
- Saved here
- 12 Nov 2026 20:16:18 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
euvd · EUVD-2026-121709
PublishedpgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered …
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Nov 10, 2026, 6:02:58 PM
dateUpdated: Nov 12, 2026, 6:02:40 PM
- Source published
- Nov 10, 2026, 6:02:58 PM (timezone not stated)
- Source modified
- Nov 12, 2026, 6:02:40 PM (timezone not stated)
- Saved here
- 14 Nov 2026 21:28:04 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd · CVE-2026-125327
PublishedpgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered …
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-405 · CWE-770
Original publisher date fields
published: 2026-11-10T19:21:09.977
lastModified: 2026-11-12T22:18:51.470
- Source published
- 10 Nov 2026 19:21:09 UTC
- Source modified
- 12 Nov 2026 22:18:51 UTC
- Saved here
- 14 Nov 2026 21:27:30 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv · GHSA-5qg5-rgp6-j5m5
PublishedpgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
### Impact An unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests. The keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which makes this a materially more effective denial-of-service lever than flooding the endpoint with ordinary requests. The amplification factor grows with corpus size, so the largest deployments are the most exposed. Hybrid search was enabled by default and configured per pipeline rather than per request, so a caller could not opt out of the keyword arm and an operator could not leave it available to some requests but not others. **Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint is reachable by an untrusted party. The endpoint required no authentication and applied no rate limiting. In `1.0.0`, `internal/database/search.go:130` built the corpus query with no `LIMIT`: ```go query = fmt.Sprintf(` SELECT ... FROM %s%s`, tableIdent, filterClause) ``` `FetchDocuments` accepted no limit parameter at all, so neither a caller nor the orchestrator had any way to bound the read. `internal/config/loader.go:197` defaulted `HybridEnabled` to true, and `internal/server/middleware.go:37` applied only logging, panic recovery and optional CORS. ### Patches **Fixed in `2.0.0`. Upgrade to `2.0.0` or later.** Reads are capped by a new per-pipeline `search.bm25_max_documents`, defaulting to 10000, plumbed through `SearchBackend.FetchDocuments` and applied as a parameterised `LIMIT`. There is deliberately no unlimited value: a non-positive setting is rejected at configuration load time rather than silently treated as unbounded. Requests that reach the cap are logged, because keyword recall is partial at that point and an operator should not have to infer it. A new `disable_hybrid` request field lets a caller skip the expensive arm per query, and can only ever turn it off. **After upgrading, review the default `search.bm25_max_documents` value of 10000 against the size of your corpus.** A cap far below corpus size silently reduces keyword recall. ### Workarounds Place the server behind an authenticating, rate-limiting reverse proxy. Setting `hybrid_enabled: false` on each pipeline removes the keyword arm and with it the unbounded read, at the cost of keyword recall. This is the only mitigation available without a proxy. Neither is a substitute for upgrading.
- Source published
- 12 Nov 2026 20:37:38 UTC
- Source modified
- 12 Nov 2026 20:45:03 UTC
- Saved here
- 12 Nov 2026 21:16:26 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Publisher rating · HIGH