CVE-2026-53965

## Summary The HTTP client transport in `mcp/sdk` reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer (`$this->sseBuffer .= $chunk;`) with **no upper bound**. The buffer is only ever flushed when an SSE event delimiter (`"\n\n"`) appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the `"\n\n"` delimiter makes `$sseBuffer` grow without limit until the client process exhausts its PHP `memory_limit` (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer. This is a denial-of-service against the MCP **client**: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data. ## Impact - **Type:** Denial of service (memory exhaustion / process crash) of the MCP client. - **Who can trigger it:** The remote MCP server endpoint the client connects to via `HttpTransport`, or any party that can control/inject into that server's SSE response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious or compromised server). The buffer growth happens while the transport is reading the response stream, before a complete event is ever parsed. - **Effect:** A response stream of N bytes containing no `"\n\n"` drives the client's resident buffer to track N. A few hundred MB of delimiter-free data is enough to kill a client running with a typical `memory_limit`. - **Severity (suggested, maintainer to confirm):** High — a remote server can reliably crash a connected client over the HTTP/SSE transport. ## How input reaches the sink (reachability) 1. A client connects to a server over the HTTP transport by constructing `Mcp\Client\Transport\HttpTransport` with the server endpoint URL, then runs the connect/request loop. 2. The transport's loop calls `tick()` (line 182), which calls `processSSEStream()` (li