Threats tagged 'ghsa-5qg5-rgp6-j5m5'

pgEdge RAG Server versions 1.0.0 and earlier have an unbounded corpus read vulnerability at the query endpoint, allowing unauthenticated callers to exhaust database and server resources. The server rebuilds an in-memory BM25 index from the entire corpus on every request without limiting the read size, causing resource consumption to scale with corpus size. Hybrid search is enabled by default and cannot be disabled per request, increasing exposure. This can lead to a denial-of-service condition. The issue is fixed in version 2.0.0 by introducing a configurable limit on documents read and allowing disabling the expensive keyword search per query.