CVE-2026-47427CWE-476

CVE-2026-47427

High · published July 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00772 · 55.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-07-28T20:18Z
Affected products (1)
ProductVersionsFixed in
github/mcp_server< 1.1.01.1.0
References (5)
https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f58 · [email protected]https://github.com/github/github-mcp-server/pull/2502 · [email protected]https://github.com/github/github-mcp-server/releases/tag/v1.1.0 · [email protected]https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 · [email protected]https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 JUL 15:32Z
    GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
    cvelistv5