CVE-2026-47427

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47427
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47427.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-47427
Aliases
Downstream
Related
Published
2026-07-28T15:32:27Z
Modified
2026-10-26T02:30:20Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
Details

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47427.json"
}
References

Affected packages

Git / github.com/github/github-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/github/github-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5be4b09c2e26e9c6adbc936b5fc661306852ebf
Fixed
c88d2ecdd3bb07f7bdd75296e3ee676febf14f58
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:github:mcp_server:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.1.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "c88d2ecdd3bb07f7bdd75296e3ee676febf14f58"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.1.0",
            "range": [
                {
                    "fixed": "c5be4b09c2e26e9c6adbc936b5fc661306852ebf"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.0-rc.1
v0.1.0-rc.2
v0.1.0-rc.3
v0.1.1
v0.1.1-release-validation
v0.10.0
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.18.0
v0.19.0
v0.19.1
v0.2.0
v0.2.1
v0.20.0
v0.20.1
v0.20.2
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.26.0
v0.26.1
v0.26.2
v0.26.3
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.3.0
v0.30.0
v0.30.1
v0.30.2
v0.30.3
v0.31.0
v0.32.0
v0.33.0
v0.33.1
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47427.json"