CVE-2026-53965: CWE-400: Uncontrolled Resource Consumption in modelcontextprotocol php-sdk

The MCP PHP SDK's HTTP client transport component incrementally reads SSE response streams and appends each chunk to an in-memory buffer without an upper bound. The buffer flushes only when a double newline delimiter is received. If a remote server streams bytes without sending this delimiter, the buffer grows without limit, leading to uncontrolled resource consumption (CWE-400) and potential denial of service due to memory exhaustion. This vulnerability affects versions 0.5.0 through 0.7.0 of the SDK. Exploitation requires only initiating a connection to a malicious or compromised server endpoint over HTTP. The issue is resolved in version 0.7.1.

An attacker controlling or compromising a remote MCP server can cause the client process to exhaust its memory by streaming SSE response bytes without the required delimiter. This results in a fatal allocation error or the operating system terminating the client process due to out-of-memory conditions, causing denial of service to the MCP client. No authentication or user interaction is required beyond establishing the connection.

Upgrade the MCP PHP SDK to version 0.7.1 or later, where this uncontrolled resource consumption issue is fixed. Until upgrading, avoid connecting the HttpTransport client to untrusted or potentially malicious servers. Patch status is confirmed fixed in version 0.7.1.