CVE-2026-125327 pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 inde...

CVE-2026-125327

The pgEdge RAG Server (prior to version 2.0.0 ) is vulnerable to resource exhaustion via unauthenticated requests. The root cause is located in the FetchDocuments function within internal/database/search.go, which reads the entire filtered corpus without a LIMIT and rebuilds an in-memory BM25 ind...