THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-7m52-jw36-44r3 (high) — MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

[GHSA] GHSA-7m52-jw36-44r3 (high) — MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

highgithub_advisoriesPublished 2026-08-19

GHSA-7m52-jw36-44r3 Severity: high CVE: CVE-2026-53965

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

## Summary

The HTTP client transport in `mcp/sdk` reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer (`$this->sseBuffer .= $chunk;`) with **no upper bound

Indicators of compromise

CVE-2026-53965cve
http://127.0.0.1:9/mcpurl

Original source: https://github.com/advisories/GHSA-7m52-jw36-44r3