CVE-2026-125327

Name of the Vulnerable Software and Affected Versions pgEdge RAG Server versions prior to 2.0.0

Description An unauthenticated query endpoint uses the FetchDocuments() function in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuilds an in-memory BM25 index on every request. Since HybridEnabled is enabled by default in internal/config/loader.go and the endpoint lacks rate limiting, remote queries can cause database and CPU consumption proportional to the corpus size, leading to resource exhaustion. BM25 is a ranking function used by search engines to estimate the relevance of documents to a given search query.

Recommendations Update to version 2.0.0.