EUVD-2026-49875
GHSA-w4q6-qw23-4rg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker accesses the exposed JSON-RPC endpoint
-
DeliveryCompletes the MCP initialization handshake
-
ExploitSends a malformed completion/complete request with missing ref field
-
ExecutionNil pointer dereference occurs in CompletionsHandler
-
PersistGo runtime panics and terminates the server process
-
ImpactService becomes unavailable.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of GitHub MCP Server versions below 1.1.0. The handler does not perform authentication checks before the vulnerable code path, so the attack requires only network reachability to the server’s JSON‑RPC endpoint. |
| Impact | The CVSS 3.1 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network‑accessible, low‑complexity vulnerability with no required privileges or user interaction, resulting in complete availability loss. While no KEV listing or EPSS data is available, the existence of a publicly documented proof‑of‑concept increases the practical risk. The vulnerability is trivially reproducible, but the impact is limited to denial of service rather than data compromise. The lack of CISA KEV designation suggests no widespread active exploitation has been observed. |
| Exploit ScenarioDerived | After completing the MCP initialization handshake, an attacker sends a JSON‑RPC request with the method |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Denial of service in GitHub MCP Server versions below 1.1.0 allows any unauthenticated attacker to crash the server by sending a malformed completion/complete JSON-RPC request with missing parameters. The nil pointer dereference occurs before authentication checks, making exploitation trivial. Publicly available exploit code exists, enabling immediate termination of the process.
RemediationAI
Upgrade to GitHub MCP Server version 1.1.0 or later, which introduces nil checks for the request parameters. The vendor advisory at https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 confirms the fix. If immediate upgrade is not feasible, restrict network access to the server’s JSON‑RPC endpoint to trusted clients only, though this may disrupt legitimate AI tool integration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The GitHub MCP Server is a Go application implementing the Model Context Protocol (MCP) to expose GitHub API resources to AI tools. The vulnerability lies in the CompletionsHandler function in pkg/github/server.go, which dereferences params.Ref without first checking for nil. The root cause is a missing null pointer validation (CWE-476), leading to a runtime panic. Affected builds are tracked by the CPE pkg:go/github.com_github_github-mcp-server for versions prior to the fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network attack with no privileges or user interaction, only availability impact.
Primary rating from Vendor (https://github.com/github/github-mcp-server).
CVSS VectorVendor: https://github.com/github/github-mcp-server
DescriptionCVE.org
Summary
A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.
Details
The CompletionsHandler function in pkg/github/server.go:198 accesses params.Ref without checking if it's nil first. When a client sends a completion/complete request with a missing ref field, the handler dereferences nil and the Go runtime panics.
The crash occurs before any authentication or token validation, so even requests with fake tokens can trigger it.
PoC
After completing the MCP initialization handshake, send either:
Empty params:
{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{}}
Missing ref field:
{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{"argument":{"name":"x","value":"y"}}}
Result:
panic: runtime error: invalid memory address or nil pointer dereference goroutine 42 [running]: github.com/github/github-mcp-server/pkg/github.NewMCPServer.CompletionsHandler.func1(...) pkg/github/server.go:198 +0x24
Impact
Any unauthenticated client that can send JSON-RPC messages to the server can crash it immediately. This is a complete denial of service - the panic is unrecoverable and kills the process.
Automated fuzzing with mcpsec found 108 crashes out of 925 test cases (11.7% crash rate).
Timeline
- Feb 21, 2026 - Initial report sent to opensource-security@github.com
- Mar 03, 2026 - Follow-up email sent, no response
- Mar 21, 2026 - Re-verified on v0.33.0, sent detailed report with PoC, no response
- Apr 06, 2026 - GHSA filed after 44 days without acknowledgment
Suggested Fix
func (s *Server) CompletionsHandler(ctx context.Context, params *mcp.CompleteParams) (*mcp.CompleteResult, error) { if params nil || params.Ref nil { return nil, fmt.Errorf("invalid request: missing ref parameter") } // ... rest of handler }
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Exploit-DB