GHSA-W4Q6-QW23-4RG7

Vulnerability from github – Published: 2026-07-28 14:35 – Updated: 2026-07-28 14:35
VLAI
Summary
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Details

Summary

A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.

Details

The CompletionsHandler function in pkg/github/server.go:198 accesses params.Ref without checking if it's nil first. When a client sends a completion/complete request with a missing ref field, the handler dereferences nil and the Go runtime panics.

The crash occurs before any authentication or token validation, so even requests with fake tokens can trigger it.

PoC

After completing the MCP initialization handshake, send either:

Empty params:

{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{}}

Missing ref field:

{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{"argument":{"name":"x","value":"y"}}}

Result:

panic: runtime error: invalid memory address or nil pointer dereference
goroutine 42 [running]:
github.com/github/github-mcp-server/pkg/github.NewMCPServer.CompletionsHandler.func1(...)
    pkg/github/server.go:198 +0x24

Impact

Any unauthenticated client that can send JSON-RPC messages to the server can crash it immediately. This is a complete denial of service - the panic is unrecoverable and kills the process.

Automated fuzzing with mcpsec found 108 crashes out of 925 test cases (11.7% crash rate).

Timeline

  • Feb 21, 2026 - Initial report sent to opensource-security@github.com
  • Mar 03, 2026 - Follow-up email sent, no response
  • Mar 21, 2026 - Re-verified on v0.33.0, sent detailed report with PoC, no response
  • Apr 06, 2026 - GHSA filed after 44 days without acknowledgment

Suggested Fix

func (s *Server) CompletionsHandler(ctx context.Context, params *mcp.CompleteParams) (*mcp.CompleteResult, error) {
    if params == nil || params.Ref == nil {
        return nil, fmt.Errorf("invalid request: missing ref parameter")
    }
    // ... rest of handler
}
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/github/github-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47427"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T14:35:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed `completion/complete` request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.\n\n### Details\n\nThe `CompletionsHandler` function in `pkg/github/server.go:198` accesses `params.Ref` without checking if it\u0027s nil first. When a client sends a `completion/complete` request with a missing `ref` field, the handler dereferences nil and the Go runtime panics.\n\nThe crash occurs before any authentication or token validation, so even requests with fake tokens can trigger it.\n\n### PoC\n\nAfter completing the MCP initialization handshake, send either:\n\n**Empty params:**\n\n    {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"completion/complete\",\"params\":{}}\n\n**Missing ref field:**\n\n    {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"completion/complete\",\"params\":{\"argument\":{\"name\":\"x\",\"value\":\"y\"}}}\n\n**Result:**\n\n    panic: runtime error: invalid memory address or nil pointer dereference\n    goroutine 42 [running]:\n    github.com/github/github-mcp-server/pkg/github.NewMCPServer.CompletionsHandler.func1(...)\n        pkg/github/server.go:198 +0x24\n\n### Impact\n\nAny unauthenticated client that can send JSON-RPC messages to the server can crash it immediately. This is a complete denial of service - the panic is unrecoverable and kills the process.\n\nAutomated fuzzing with mcpsec found 108 crashes out of 925 test cases (11.7% crash rate).\n\n### Timeline\n\n- **Feb 21, 2026** - Initial report sent to opensource-security@github.com\n- **Mar 03, 2026** - Follow-up email sent, no response\n- **Mar 21, 2026** - Re-verified on v0.33.0, sent detailed report with PoC, no response\n- **Apr 06, 2026** - GHSA filed after 44 days without acknowledgment\n\n### Suggested Fix\n\n    func (s *Server) CompletionsHandler(ctx context.Context, params *mcp.CompleteParams) (*mcp.CompleteResult, error) {\n        if params == nil || params.Ref == nil {\n            return nil, fmt.Errorf(\"invalid request: missing ref parameter\")\n        }\n        // ... rest of handler\n    }",
  "id": "GHSA-w4q6-qw23-4rg7",
  "modified": "2026-07-28T14:35:10Z",
  "published": "2026-07-28T14:35:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/github-mcp-server/pull/2502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f58"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/github/github-mcp-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/github-mcp-server/releases/tag/v1.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.