CVE-2026-53965: MCP PHP SDK Memory Exhaustion DOS Vulnerability

CVE-2026-53965 Overview

CVE-2026-53965 is a denial-of-service vulnerability in the Model Context Protocol (MCP) PHP SDK, distributed as the Composer package mcp/sdk. The flaw affects versions 0.5.0 through 0.7.0 and resides in the HTTP client transport that consumes Server-Sent Events (SSE) response streams. The transport buffers incoming chunks in memory without any size cap and only flushes when it detects the SSE event delimiter (a double newline). A malicious or compromised MCP server can stream bytes without ever emitting the delimiter, forcing the client to exhaust process memory. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption] and is fixed in version 0.7.1.

Critical Impact
Any PHP client using HttpTransport to connect to an untrusted MCP server can be forced into a fatal memory allocation error or OS out-of-memory kill, denying service to the client process.

Affected Products

mcp/sdk Composer package version 0.5.0
mcp/sdk Composer package versions 0.6.x
mcp/sdk Composer package version 0.7.0

Discovery Timeline

2026-08-25 - CVE-2026-53965 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-53965

Vulnerability Analysis

The MCP PHP SDK provides HTTP-based transport for clients that talk to Model Context Protocol servers. The affected transport reads SSE response streams incrementally and appends each network chunk to an in-memory buffer. The buffer is only drained when the parser locates the SSE event delimiter, which is a sequence of two consecutive newline characters. Because the implementation applies no upper bound on buffer growth, a server that indefinitely streams bytes without emitting the delimiter causes memory usage to grow until the PHP process fails allocation or is terminated by the operating system.

The outcome is a reliable denial-of-service condition against the client. Exploitation does not require authentication or user interaction beyond initiating the outbound HTTP transport connection. Any deployment that connects HttpTransport to third-party or attacker-controlled MCP endpoints is exposed.

Root Cause

The root cause is missing input size validation on the SSE receive path. The parser treats the delimiter as the sole flush trigger and never enforces a maximum event or buffer size. This maps to [CWE-400: Uncontrolled Resource Consumption] and represents a classic protocol parser weakness where framing assumptions are trusted without defensive limits.

Attack Vector

An attacker who controls or intercepts an MCP server endpoint returns an HTTP response with a valid SSE Content-Type and then streams arbitrary bytes indefinitely without sending \n\n. Man-in-the-middle attackers on unauthenticated or improperly validated TLS paths can achieve the same result. The client continues appending data to its internal buffer until the PHP runtime reaches the memory_limit and terminates, or the kernel OOM-killer reaps the process.

See the GitHub Security Advisory for the fix diff and parser details:
https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3

Detection Methods for CVE-2026-53965

Indicators of Compromise

Unexpected PHP process terminations with Allowed memory size of N bytes exhausted errors in application logs.
Linux dmesg or journalctl entries showing the OOM killer terminating PHP worker processes handling MCP traffic.
Long-lived outbound HTTP connections from PHP workers to MCP server endpoints with continuously growing received-byte counters and no response completion.

Detection Strategies

Inventory Composer lockfiles across the estate and flag any project resolving mcp/sdk to a version between 0.5.0 and 0.7.0 inclusive.
Instrument the HTTP transport layer to record per-connection received-byte totals and alert when a single SSE response exceeds a reasonable threshold without emitting an event.
Correlate PHP fatal memory errors with concurrent outbound connections to MCP endpoints to identify active exploitation attempts.

Monitoring Recommendations

Monitor egress destinations for PHP application servers and restrict MCP client connections to an allowlist of trusted servers.
Track PHP worker restart rates and memory-limit violations as leading indicators of resource-exhaustion abuse.
Log TLS certificate metadata for MCP endpoints to detect man-in-the-middle substitution that could enable this attack.

How to Mitigate CVE-2026-53965

Immediate Actions Required

Upgrade the mcp/sdk Composer package to version 0.7.1 or later on every host that runs an MCP client.
Audit application configuration to confirm that HttpTransport targets only trusted, authenticated MCP server endpoints.
Enforce strict TLS certificate validation on all outbound MCP HTTP connections to eliminate man-in-the-middle exploitation paths.

Patch Information

The maintainers released the fix in GitHub Release v0.7.1. The parser change is documented in the upstream commit and the coordinated advisory is published as GHSA-7m52-jw36-44r3.

Workarounds

Restrict MCP client connections to servers under organizational control until the patched release is deployed.
Lower the PHP memory_limit for MCP worker processes so a single hung connection cannot exhaust host memory, and run workers under a process supervisor that restarts them cleanly.
Place an outbound HTTP proxy between the PHP client and remote MCP servers that enforces response size ceilings and idle-stream timeouts.

bash

# Upgrade the vulnerable package to the fixed release
composer require mcp/sdk:^0.7.1
composer update mcp/sdk

# Verify the resolved version
composer show mcp/sdk | grep versions