CVE-2026-47427 with a CVSS score of 7.5 is a high-severity denial-of-service vulnerability affecting GitHub's official GitHub MCP Server framework. The technical root cause is a nil pointer dereference within the CompletionsHandler function, specifically where the application attempts to access the params.Ref object without first verifying its existence. An attacker can exploit this weakness remotely over the network by transmitting a malicious JSON-RPC completion/complete request that lacks the required ref field or contains empty parameters. Since the triggering condition occurs before the server performs authentication or token validation, any unauthenticated actor can exploit this flaw without requiring user interaction or privileges. This induces a Go runtime panic that immediately crashes the server process, leading to a total and unrecoverable denial of service. For businesses, this disruption halts critical workflow integrations, significantly impacting productivity and availability until the service is manually restarted.
We recommend you to update github.com/github/github-mcp-server to version 1.7.0 or later.[/subscribe_to_unlock_form]
CVE-2026-47427 with a CVSS score of 7.5 is a high-severity denial-of-service vulnerability affecting GitHub's official GitHub MCP Server framework. The technical root cause is a nil pointer dereference within the CompletionsHandler function, specifically where the application attempts to access the params.Ref object without first verifying its existence. An attacker can exploit this weakness remotely over the network by transmitting a malicious JSON-RPC completion/complete request that lacks the required ref field or contains empty parameters. Since the triggering condition occurs before the server performs authentication or token validation, any unauthenticated actor can exploit this flaw without requiring user interaction or privileges. This induces a Go runtime panic that immediately crashes the server process, leading to a total and unrecoverable denial of service. For businesses, this disruption halts critical workflow integrations, significantly impacting productivity and availability until the service is manually restarted.
We recommend you to update github.com/github/github-mcp-server to version 1.7.0 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]