CyberRota Analysis
AI-GeneratedThe GitHub MCP Server is vulnerable to a denial-of-service attack due to a nil pointer dereference in the CompletionsHandler function, which can be triggered by unauthenticated clients sending malformed JSON-RPC messages. This vulnerability allows attackers to crash the server without any authentication or token validation, leading to service disruption. Organizations using versions prior to 1.1.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)