CVE-2026-47427

Name of the Vulnerable Software and Affected Versions GitHub MCP Server versions prior to 1.1.0

Description A nil pointer dereference occurs in the CompletionsHandler() function within pkg/github/server.go when processing a completion/complete request. The issue arises because the server accesses the params.Ref variable without verifying if it is nil. An unauthenticated client can trigger a Go runtime panic by sending a JSON-RPC message with a missing or empty ref field. Since this crash happens before authentication or token validation, it allows any client capable of sending such messages to cause a complete denial of service.

Recommendations Update GitHub MCP Server to version 1.1.0.