CVE-2026-53965

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process's memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process's memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

Summary

The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memory_limit (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer.

This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data.

Impact

• Type: Denial of service (memory exhaustion / process crash) of the MCP client.
• Who can trigger it: The remote MCP server endpoint the client connects to via HttpTransport, or any party that can control/inject into that server's SSE response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious or compromised server). The buffer growth happens while the transport is reading the response stream, before a complete event is ever parsed.
• Effect: A response stream of N bytes containing no "\n\n" drives the client's resident buffer to track N. A few hundred MB of delimiter-free data is enough to kill a client running with a typical memory_limit.
• Severity (suggested, maintainer to confirm): High — a remote server can reliably crash a connected client over the HTTP/SSE transport.

How input reaches the sink (reachability)

1. A client connects to a server over the HTTP transport by constructing Mcp\Client\Transport\HttpTransport with the server endpoint URL, then runs the connect/request loop.
2. The transport's loop calls tick() (line 182), which calls processSSEStream() (line 194) on each iteration.
3. processSSEStream() reads up to 4096 bytes from the active SSE stream and appends them to $this->sseBuffer (line 203).
4. The buffer is only drained inside the while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) loop (line 207). If the server never emits "\n\n", the strpos never matches, the buffer is never flushed, and it grows on every tick() until OOM.

Vulnerable code

src/Client/Transport/HttpTransport.php (v0.5.0):

    private string $sseBuffer = '';

    private function processSSEStream(): void
    {
        if (null === $this->activeStream) {
            return;
        }

        if (!$this->activeStream->eof()) {
            $chunk = $this->activeStream->read(4096);
            if ('' !== $chunk) {
                $this->sseBuffer .= $chunk;          // line 203 — unbounded append
            }
        }

        while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) {
            $event = substr($this->sseBuffer, 0, $pos);
            $this->sseBuffer = substr($this->sseBuffer, $pos + 2);

            if (!empty(trim($event))) {
                $this->processSSEEvent($event);
            }
        }

        if ($this->activeStream->eof() && empty($this->sseBuffer)) {
            $this->activeStream = null;
        }
    }

$this->sseBuffer .= $chunk; has no length guard; the drain loop only fires when a "\n\n" delimiter is present.

Proof of concept / End-to-end reproduction (against the released composer package)

Environment: macOS arm64, PHP 8.5.6 (cli), Composer 2.9.8. The package under test is the real published release mcp/sdk v0.5.0 (the version that introduced this HTTP client transport), installed from Packagist — not a re-implementation of the sink.

Install the released package:

$ composer require mcp/sdk:0.5.0 --no-interaction
  - Installing mcp/sdk (v0.5.0): Extracting archive
$ composer show mcp/sdk
name     : mcp/sdk…

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process's memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process's memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

Summary

The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memory_limit (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer.

This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data.

Impact

• Type: Denial of service (memory exhaustion / process crash) of the MCP client.
• Who can trigger it: The remote MCP server endpoint the client connects to via HttpTransport, or any party that can control/inject into that server's SSE response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious or compromised server). The buffer growth happens while the transport is reading the response stream, before a complete event is ever parsed.
• Effect: A response stream of N bytes containing no "\n\n" drives the client's resident buffer to track N. A few hundred MB of delimiter-free data is enough to kill a client running with a typical memory_limit.
• Severity (suggested, maintainer to confirm): High — a remote server can reliably crash a connected client over the HTTP/SSE transport.

How input reaches the sink (reachability)

1. A client connects to a server over the HTTP transport by constructing Mcp\Client\Transport\HttpTransport with the server endpoint URL, then runs the connect/request loop.
2. The transport's loop calls tick() (line 182), which calls processSSEStream() (line 194) on each iteration.
3. processSSEStream() reads up to 4096 bytes from the active SSE stream and appends them to $this->sseBuffer (line 203).
4. The buffer is only drained inside the while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) loop (line 207). If the server never emits "\n\n", the strpos never matches, the buffer is never flushed, and it grows on every tick() until OOM.

Vulnerable code

src/Client/Transport/HttpTransport.php (v0.5.0):

    private string $sseBuffer = '';

    private function processSSEStream(): void
    {
        if (null === $this->activeStream) {
            return;
        }

        if (!$this->activeStream->eof()) {
            $chunk = $this->activeStream->read(4096);
            if ('' !== $chunk) {
                $this->sseBuffer .= $chunk;          // line 203 — unbounded append
            }
        }

        while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) {
            $event = substr($this->sseBuffer, 0, $pos);
            $this->sseBuffer = substr($this->sseBuffer, $pos + 2);

            if (!empty(trim($event))) {
                $this->processSSEEvent($event);
            }
        }

        if ($this->activeStream->eof() && empty($this->sseBuffer)) {
            $this->activeStream = null;
        }
    }

$this->sseBuffer .= $chunk; has no length guard; the drain loop only fires when a "\n\n" delimiter is present.

Proof of concept / End-to-end reproduction (against the released composer package)

Environment: macOS arm64, PHP 8.5.6 (cli), Composer 2.9.8. The package under test is the real published release mcp/sdk v0.5.0 (the version that introduced this HTTP client transport), installed from Packagist — not a re-implementation of the sink.

Install the released package:

$ composer require mcp/sdk:0.5.0 --no-interaction
  - Installing mcp/sdk (v0.5.0): Extracting archive
$ composer show mcp/sdk
name     : mcp/sdk…