# CVE-2026-125327: pgEdge RAG Server denial of service via unbounded corpus read

Source: https://junglewise.ai/threats/cve-2026-125327-pgedge-rag-server-is-an-api-server-for-retrieval-augmented  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125327 · Severity: high · CVSS 7.5 · Published 2026-11-10

pgEdge RAG Server is an API service that provides AI-powered document search over PostgreSQL databases. An unauthenticated attacker can repeatedly query the search endpoint to force the server to read and process its entire document corpus without limits, consuming excessive database and CPU resources and potentially rendering the service unavailable to legitimate users.

Technologies: [github.com/pgEdge/pgedge-rag-server (Go)](https://junglewise.ai/threats/technologies/github-com-pgedge-pgedge-rag-server), [pgEdge RAG Server](https://junglewise.ai/threats/technologies/rag-server). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [pgEdge](https://junglewise.ai/threats/vendors/pgedge).

## Quick answers

**Is CVE-2026-125327 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125327 being exploited in the wild.

**How severe is CVE-2026-125327?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** github.com/pgEdge/pgedge-rag-server (Go) < 1.0.1-0.20260729020411-a09d4872356b; pgEdge RAG Server prior to 2.0.0.

**Is there a fix for CVE-2026-125327?** Yes: fixed in 2.0.0. Until then: Disable hybrid search at the configuration level by setting HybridEnabled to false, or restrict network access to the query endpoint until the service can be upgraded. Individual requests can also use the disable_hybrid parameter to skip the expensive BM25 index operation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-10"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125327 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125327?** Check whether you run github.com/pgEdge/pgedge-rag-server (Go) or pgEdge RAG Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.0

Disable hybrid search at the configuration level by setting HybridEnabled to false, or restrict network access to the query endpoint until the service can be upgraded. Individual requests can also use the disable_hybrid parameter to skip the expensive BM25 index operation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-10"}]

## Technical details

The vulnerability exists in the unauthenticated query endpoint, which uses FetchDocuments to read the entire filtered corpus without a LIMIT clause and rebuilds an in-memory BM25 index on every request. With hybrid search enabled by default and no rate limiting in place, remote attackers can trigger expensive database reads and CPU-intensive index operations proportional to corpus size. The fix in version 2.0.0 introduces a configurable cap on corpus reads (default 10,000 documents) and moves BM25 index construction to per-request scope rather than sharing a single index across concurrent requests.

## Affected products

- pgEdge RAG Server prior to 2.0.0

## Identifiers

- CVE-2026-125327
- GHSA-5qg5-rgp6-j5m5

## References

- [https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84](https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84)
- [https://github.com/pgEdge/pgedge-rag-server/pull/44](https://github.com/pgEdge/pgedge-rag-server/pull/44)

## Related threats

- [pgEdge RAG Server credential leak in error responses](https://junglewise.ai/threats/cve-2026-125326-pgedge-rag-server-is-an-api-server-for-retrieval-augmented)
- [pgEdge RAG Server concurrent query data isolation bypass](https://junglewise.ai/threats/cve-2026-125325-pgedge-rag-server-is-an-api-server-for-retrieval-augmented)