The MCP PHP SDK’s HttpTransport reads Server‑Sent Events streams into an unbounded in‑memory buffer. Because the buffer is only flushed when a double‑newline delimiter is received, a server that streams data continuously without sending the delimiter causes the buffer to grow without limit. This leads to exhaustion of the client process’s memory, resulting in a fatal allocation error or an OS or kernel memory kill, and effectively denies service to the MCP client. The flaw is a classic resource‑exhaustion weakness, corresponding to CWE‑400 and CWE‑770.

The vulnerability afflicts Model Context Protocol PHP SDK (Composer package mcp/sdk) versions 0.5.0 through 0.7.0. Any client that uses HttpTransport to connect to an untrusted MCP server is susceptible.

The CVSS score of 6.9 classifies the issue as moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by controlling the target MCP server or performing a man‑in‑the‑middle attack; no authentication or user interaction is required beyond initiating the HTTP connection. The attack vector is remote and relies solely on the network connection to the untrusted server.