Memory Exhaustion Vulnerability in MCP PHP SDK Affects Model Context Protocol
CVE-2026-53965

6.9MEDIUM

Key Information:

Vendor

Modelcontextprotocol

Status
PHP-sdk
Vendor
CVE Published:
25 August 2026

What is CVE-2026-53965?

The MCP PHP SDK versions 0.5.0 to 0.7.0 is vulnerable due to improper handling of Server-Sent Events. The HTTP client transport reads response streams incrementally, appending data to an unbounded in-memory buffer, which can grow indefinitely when no delimiter is received. This vulnerability can be exploited by a malicious actor controlling the remote server, potentially leading to memory exhaustion and denial of service on the client process. The issue has been addressed in version 0.7.1.

Affected Version(s)

php-sdk >= 0.5.0, < 0.7.1

References

https://github.com/modelcontextprotocol/php-sdk/security/...
x_refsource_CONFIRM
https://github.com/modelcontextprotocol/php-sdk/commit/05...
x_refsource_MISC
https://github.com/modelcontextprotocol/php-sdk/releases/...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.