CVE-2026-53965: official PHP SDK client buffered SSE responses without bound; fixed in 0.7.1 eleven days before the record

CVE-2026-53965 was published to NVD on 2026-08-25 against the official Model Context Protocol PHP SDK, distributed as the Composer package mcp/sdk. The fix is not new: the repository advisory (GHSA-7m52-jw36-44r3, severity high) and the patched v0.7.1 release both went out on 2026-08-14, within the same minute. The record trails the fix by eleven days.

The defect sits on the client side of the HTTP transport. Reading a Server-Sent Events response stream, the transport appended each chunk to an in-memory buffer and only flushed the buffer when it found the SSE event delimiter, a double newline. A server that streams bytes without ever sending the delimiter grows the buffer without limit. Per the CNA record, a malicious, compromised, or man-in-the-middle-controlled server the client connects to can exhaust the client process's memory and trigger a fatal allocation error or an operating-system out-of-memory kill. Versions 0.5.0 through 0.7.0 are affected.

The direction distinguishes this record: it is a hostile-server attack on MCP clients, where most records this summer have been hostile-client attacks on servers. The problem class is familiar in both directions. The Java SDK's two unbounded-read advisories (2026-08-19) and the Python SDK's extension of its 4 MiB body limit to SSE and OAuth endpoints (2026-08-24) worked the same resource-bounding problem in their own transports.

The PHP SDK has since moved on: v0.8.0 shipped on 2026-08-25 with the SDK's 2026-07-28 revision surface, and carries the fix.