High, CVSS 8.7PackagistAmendedPublished
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
CVE-2026-53965 · GHSA-7m52-jw36-44r3
- Affected
- Packagist mcp/sdk >= 0.5.0, < 0.7.1
- Fixed in
- 0.7.1· Vendor fix available
- Issue
- The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this-sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memorylimit (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer. This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data. Impact - Type: Denial of service (memory exhaustion / process crash) of the MCP client. - Who can trigger it: The remote MCP server endpoint the client connects to via HttpTransport, or any party…
Recommended action: Upgrade to 0.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.