CVE-2026-53965: MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memory_limit (fatal “Allowed memory size … exhausted”) or is killed by the OS OOM-killer.

This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server’s response body — can crash the client by withholding the event delimiter while streaming data.