Am I affected by MCP PHP SDK: client HttpTransport SSE buffer grows unbounded when server withholds the…? What should I do?
The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer with no upper bound.
Affected: mcp/sdk >= 0.5.0, < 0.7.1. Fixed in: 0.7.1. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/cve-2026-53965-mcp-sdk (opens external site)
1 answer
Am I affected? Affected: mcp/sdk >= 0.5.0, < 0.7.1. Fixed in: 0.7.1.
What to do now
- Bound the SSE buffer length and reject (or abort the stream) when it exceeds a configured maximum.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-7m52-jw36-44r3 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/08/cve-2026-53965-mcp-sdk (opens external site)
Did this work for you?