GHSA-3X6R-WXXG-53VV rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

Summary A transport failure during the initial Infinite Scale TUS creation POST can return nil response, non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint. The security...

CVE-2026-70616

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

CVE-2026-55998

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998

The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

EUVD-2026-49875

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427

The vulnerability CVE-2026-47427 affects GitHub MCP Server. The CompletionsHandler in pkg/github/server.go dereferences params.Ref without nil-checking, so a completion/complete request with a missing or empty ref can trigger a nil pointer dereference, causing a Go runtime panic and an immediate ...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

GHSA-W4Q6-QW23-4RG7 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service. Details The CompletionsHandler functio...

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service. Details The CompletionsHandler functio...

PT-2026-65504

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

GHSA-JPCW-4WR7-C3VQ kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp

GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to the unconditional substitution of a nil AuthenticationFunc with a no-op function in the Load process. An attacker can gain unauthorized access to protected endpoints by sending unauthenticated requests, as...

PT-2026-76594

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.2.0 through 0.143.0 Description An unauthenticated remote denial of service exists when the openapi3filter.ValidateRequest function processes an operation that declares a content parameter where the application/json medi...

GHSA-M932-CRVM-GCP5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...