Denial of Service Vulnerability in GitHub MCP Server

CVE-2026-47427

What is CVE-2026-47427?

The GitHub MCP Server, a crucial tool for handling JSON-RPC messages, is susceptible to a denial of service issue in versions prior to 1.1.0. The flaw occurs in the CompletionsHandler function where it accesses params.Ref without checking for nil values. This oversight can lead to a nil pointer dereference if the ref field is empty or missing, causing a Go runtime panic and ultimately crashing the server. Unauthenticated clients can exploit this vulnerability to send requests that trigger server instability before any authentication processes occur. As a result, administrators must upgrade to version 1.1.0 to mitigate this risk.

References