The MCP Server's CompletionsHandler accesses the ref field of the completion/complete request without null checking. A client that omits or sends an empty ref value triggers a nil pointer dereference, causing a Go runtime panic. Because this occurs before any authentication or token validation, any unauthenticated client can force the service to crash, leading to a complete denial of service. The flaw does not disclose data or grant privileged execution, but it can disrupt service availability.

GitHub's official MCP Server (github-mcp-server) is affected. Any release version prior to v1.1.0 is vulnerable. The issue was addressed and fixed in v1.1.0; all later releases contain the patch. No other products or vendors are affected according to the CNA dataset.

The CVSS score of 7.5 places this vulnerability in the high severity range, while the EPSS score of less than 1% indicates a low probability of active exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated; an attacker can send a JSON-RPC completion request with a missing or empty ref field to any exposed MCP Server instance to trigger a crash. Because the service has no authentication step for this endpoint, the exploit requires only network access and no special privileges.