Threats tagged 'ghsa-w437-9mwm-j6vq'

pgEdge RAG Server versions 1.0.0 and earlier have a concurrency flaw causing shared keyword index leakage between unauthenticated concurrent requests. This allows documents from one caller to be returned to another, defeating tenant or customer scoping filters without requiring injection or malformed input. The issue is fixed in version 2.0.0 by building the index per request instead of sharing it. Workarounds include disabling the hybrid keyword index feature, but upgrading is strongly recommended.