This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-125327 | BDVDB-2026-404642 Detail

pgEdgepgedge-rag-server

Description#

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-405 Asymmetric Resource Consumption (Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.