Go · github.com/github/github-mcp-server
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.
The CompletionsHandler function in pkg/github/server.go:198 accesses params.Ref without checking if it's nil first. When a client sends a completion/complete request with a missing ref field, the handler dereferences nil and the Go runtime panics.
The crash occurs before any authentication or token validation, so even requests with fake tokens can trigger it.
After completing the MCP initialization handshake, send either:
Empty params:
{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{}}
Missing ref field:
{"jsonrpc":"2.0","id":2,"method":"completion/complete","params":{"argument":{"name":"x","value":"y"}}}
Result:
panic: runtime error: invalid memory address or nil pointer dereference
goroutine 42 [running]:
github.com/github/github-mcp-server/pkg/github.NewMCPServer.CompletionsHandler.func1(...)
pkg/github/server.go:198 +0x24
Any unauthenticated client that can send JSON-RPC messages to the server can crash it immediately. This is a complete denial of service - the panic is unrecoverable and kills the process.
Automated fuzzing with mcpsec found 108 crashes out of 925 test cases (11.7% crash rate).
func (s *Server) CompletionsHandler(ctx context.Context, params *mcp.CompleteParams) (*mcp.CompleteResult, error) {
if params == nil || params.Ref == nil {
return nil, fmt.Errorf("invalid request: missing ref parameter")
}
// ... rest of handler
}
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.