HIGH 7.5 GitHub
CVE-2026-47427
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
### Summary
A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed `completion/complete` request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.
### Details
The `CompletionsHandler` function in `pkg/github/server.go:198` accesses `params.Ref` without checking if it's nil first. When a client sends a `completion/complete` request with a missing `ref` field, the handler derefe
Affected Products
- go/github.com/github/github-mcp-server < 1.1.0
References
- https://github.com/advisories/GHSA-w4q6-qw23-4rg7
- https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7
- https://github.com/github/github-mcp-server/pull/2502
- https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f5
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-07-28 via GitHub. Affected: go/github.com/github/github-mcp-server < 1.1.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.