CVE-2026-47427

Katalog CVE

CVSS 7.5 · High EPSS 0,77%

Kerentanan NULL Pointer Dereference pada github mcp server. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.

Rincian

Terbit di NVD

28 Juli 2026

Terakhir diubah

8 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 exploit · advisory vendor
• https://github.com/github/github-mcp-server/commit/c88d2ecdd3bb07f7bdd75296e3ee676febf14f58 patch
• https://github.com/github/github-mcp-server/pull/2502 issue tracking · patch
• https://github.com/github/github-mcp-server/releases/tag/v1.1.0 release notes