https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:58:02.735843+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342159 EUVD-2026-342159 2026-10-05T15:58:02.785074+00:00 EUVD-2026-342159 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47427 fkie_cve-2026-47427 2026-10-05T15:58:02.785113+00:00

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-w4q6-qw23-4rg7 GHSA-w4q6-qw23-4rg7 — GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler 2026-10-05T15:58:02.785149+00:00

Affected: Go: github.com/github/github-mcp-server

### Summary

A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed `completion/complete` request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.

### Details

The `CompletionsHandler` function in `pkg/github/server.go:198` accesses `params.Ref` without checking if it's nil first. When a client sends a `completion/complete` request with a missing `ref` field, the handler dereferences nil and the Go runtime panics.

The crash occurs before any authentication or token validation, so even requests with fake tokens can trigger it.

### PoC

After completing the MCP initialization handshake, send either:

**Empty params:**

{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{}}

**Missing ref field:**

{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{"argument":{"name":"x","value":"y"}}}

**Result:**

panic: runtime error: invalid memory address or nil pointer dereference goroutine 42 [running]: github.com/github/github-mcp-server/pkg/github.NewMCPServer.CompletionsHandler.func1(...) pkg/github/server.go:198 +0x24

### Impact

Any unauthenticated client that can send JSON-RPC messages to the server can crash it immediately. This is a complete denial of service - the panic is unrecoverable and kills the process.

Automated fuzzing with mcpsec found 108 crashes out of 925 test cases (11.7% crash rate).

###…