Threat Advisory

MCP PHP SDK HTTP Client Transport Denies Service with Unlimited Buffer Growth

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-53965 with a CVSS score of 8.7 is a denial-of-service vulnerability affecting mcp/sdk versions >= 0.5.0, < 0.7.1 against the MCP client, caused by an unbounded buffer growth in the HTTP client transport's SSE response stream handling. The transport reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer with no upper bound. A remote MCP server that streams response bytes without ever sending the event delimiter makes the buffer grow without limit until the client process exhausts its PHP memory_limit or is killed by the OS OOM-killer. This allows a remote server to reliably crash a connected client over the HTTP/SSE transport, making it a high-severity vulnerability.

RECOMMENDATION:

We recommend you to update mcp/sdk to version 0.7.1.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-53965 with a CVSS score of 8.7 is a denial-of-service vulnerability affecting mcp/sdk versions >= 0.5.0, < 0.7.1 against the MCP client, caused by an unbounded buffer growth in the HTTP client transport's SSE response stream handling. The transport reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer with no upper bound. A remote MCP server that streams response bytes without ever sending the event delimiter makes the buffer grow without limit until the client process exhausts its PHP memory_limit or is killed by the OS OOM-killer. This allows a remote server to reliably crash a connected client over the HTTP/SSE transport, making it a high-severity vulnerability.

RECOMMENDATION:

We recommend you to update mcp/sdk to version 0.7.1.[emaillocker id="1283"]

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu