HIGHCVSS v3.1 7.5Vulnerability
CVE-2026-125327
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.5
- Retrieved at
- 2026-11-10T23:34:23+00:00
- Score
- 7.5
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-125327
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- First seen by Signal
- 2026-11-10T19:28:56+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Published at
- 2026-11-10T19:21:09.977
- Last modified
- 2026-11-10T19:21:09.977
Related Entities (2)
HAS_WEAKNESS (2)
Related research
Explore deeper with Ninja Signal's threat intelligence graph