Hoch 7.5Software
CVE-2026-125327
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
github.com/pgEdge/pgedge-rag-server
### Impact An unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests. The keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which…
10. Nov 2026
Original bei NVD öffnen