MCP PHP SDK Unbounded SSE Buffer Memory Exhaustion DoS
First seen Aug 26, 2026 · Updated Aug 26, 2026
The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.
Technical Analysis
The HttpTransport component in mcp/sdk versions 0.5.0-0.7.0 reads SSE response streams incrementally, appending each received chunk to an in-memory buffer and only flushing it when a double-newline event delimiter is encountered. A malicious MCP server endpoint can stream arbitrary bytes indefinitely while never emitting the delimiter, causing the client's buffer to grow unbounded until the PHP process hits a fatal memory allocation error or is OOM-killed by the host OS. The entry point is any client-initiated connection to an untrusted or attacker-controlled MCP server over the HTTP transport, meaning trust in the server endpoint is misplaced and crosses the client/server boundary defined by the MCP protocol. The attacker gains denial of service against the agent client process, potentially disrupting downstream agent workflows or orchestration pipelines that depend on that MCP client remaining available.
Affected Systems
mcp/sdk (MCP PHP SDK); protocols: MCP
Detection Signatures
- Anomalous MCP HTTP transport connections showing continuously growing response body with no SSE double-newline delimiter observed
- Sudden PHP fatal error: Allowed memory size exhausted in HttpTransport-related stack traces
- OOM-killer log entries correlated with MCP client PHP process during active SSE stream
- Long-lived SSE connections from MCP client to unfamiliar or newly-added server endpoints with no data delimiter emitted
Remediation Steps
- 1
Upgrade mcp/sdk
Update the MCP PHP SDK Composer package to version 0.7.1 or later, which fixes the unbounded buffer issue.
- 2
Enforce buffer/stream limits
If upgrading is not immediately possible, wrap HttpTransport usage with a proxy or middleware that enforces a maximum response size and connection timeout.
- 3
Restrict trusted server endpoints
Only connect MCP clients to vetted, allow-listed MCP server endpoints and avoid dynamic or user-supplied server URLs.
- 4
Add resource monitoring
Deploy memory/resource monitoring and automatic process restarts for MCP client processes to reduce the impact of a successful DoS.
- 5
Network-level safeguards
Use TLS with certificate validation and network egress controls to reduce risk of man-in-the-middle-controlled MCP servers.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.