CVE-2026-125327

Query processing could exhaust resources by rebuilding the keyword index

pgEdge · RAG Server hybrid search

First documented disclosure · Review checkpoint

Summary

The search worker loaded an unbounded corpus and rebuilt its in-memory index per request. Database, CPU and memory demand could make retrieval unavailable.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The search worker loaded an unbounded corpus and rebuilt its in-memory index per request.

Conditions required

The unauthenticated query API was reachable with hybrid search, which was enabled by default.

Potential impact

Database, CPU and memory demand could make retrieval unavailable.

Affected versions and configurations

Maintainer lists releases through 1.0.0. CNA describes versions before 2.0.0.

Fix and mitigation status

2.0.0.

Practical next steps

Upgrade RAG Server and restrict or rate-limit public access to retrieval queries.

Operating lesson

Give AI retrieval and tool services database credentials scoped to the data they need.

Evidence and limits

The public disclosure was on 2026-09-03. The CVE record was published on 2026-11-10.

Sources