CVE-2026-53965 with a CVSS score of 8.7 is a denial-of-service vulnerability affecting mcp/sdk versions >= 0.5.0, < 0.7.1 against the MCP client, caused by an unbounded buffer growth in the HTTP client transport's SSE response stream handling. The transport reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer with no upper bound. A remote MCP server that streams response bytes without ever sending the event delimiter makes the buffer grow without limit until the client process exhausts its PHP memory_limit or is killed by the OS OOM-killer. This allows a remote server to reliably crash a connected client over the HTTP/SSE transport, making it a high-severity vulnerability.
We recommend you to update mcp/sdk to version 0.7.1.[/subscribe_to_unlock_form]
CVE-2026-53965 with a CVSS score of 8.7 is a denial-of-service vulnerability affecting mcp/sdk versions >= 0.5.0, < 0.7.1 against the MCP client, caused by an unbounded buffer growth in the HTTP client transport's SSE response stream handling. The transport reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer with no upper bound. A remote MCP server that streams response bytes without ever sending the event delimiter makes the buffer grow without limit until the client process exhausts its PHP memory_limit or is killed by the OS OOM-killer. This allows a remote server to reliably crash a connected client over the HTTP/SSE transport, making it a high-severity vulnerability.
We recommend you to update mcp/sdk to version 0.7.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]