What happened
The retrieval endpoint reads the whole filtered corpus and rebuilds a BM25 index on each request, with no LIMIT or concurrency control, so a single request against a large corpus can exhaust resources. CVSS 7.5.
Why it matters
RAG servers are exposed to agents and, increasingly, to attacker-controlled prompts that drive repeated expensive queries. An unauthenticated endpoint with no LIMIT is a cheap way to knock out the retrieval layer a production RAG/agent pipeline depends on.
Attack vector
The unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus with no LIMIT and rebuild an in-memory BM25 index over it, exhausting memory/CPU and denying service.
Affected systems
pgEdge RAG Server < 2.0.0
Mitigation
Upgrade pgEdge RAG Server to 2.0.0 (commit a09d4872356b510c81f11591845445c33ff45a84).