CVE-2026-125327: pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgEdge RAG Serverto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Are deployments affected under the default configuration?
Yes. HybridEnabled is enabled by default, and the unauthenticated query endpoint has no rate limit, so default deployments prior to 2.0.0 are exposed if the endpoint is reachable remotely.
What does an attacker need to exploit this issue?
An attacker only needs network access to the unauthenticated query endpoint. No authentication, privileges, or user interaction are required, and inexpensive queries can trigger work proportional to the filtered corpus size.
What is the practical impact of exploitation?
Repeated requests can force full filtered-corpus reads, database work, and rebuilding of an in-memory BM25 index for each request. This can exhaust CPU and service resources, resulting in denial of service.
What should teams do if they cannot immediately upgrade?
Restrict network access to the unauthenticated query endpoint and apply request rate limiting where possible. These measures reduce exposure because the endpoint otherwise permits unrestricted unauthenticated requests.
Which version fixes the issue?
The issue is fixed in pgEdge RAG Server version 2.0.0. Versions prior to 2.0.0 are affected.