MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Summary

The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the client process exhausts its PHP memory_limit (fatal "Allowed memory size … exhausted") or is killed by the OS OOM-killer.

This is a denial-of-service against the MCP client: any server it talks to — or a network position that controls the server's response body — can crash the client by withholding the event delimiter while streaming data.

Impact

• Type: Denial of service (memory exhaustion / process crash) of the MCP client.
• Who can trigger it: The remote MCP server endpoint the client connects to via HttpTransport, or any party that can control/inject into that server's SSE response body (e.g. a man-in-the-middle on a plaintext endpoint, or a malicious or compromised server). The buffer growth happens while the transport is reading the response stream, before a complete event is ever parsed.
• Effect: A response stream of N bytes containing no "\n\n" drives the client's resident buffer to track N. A few hundred MB of delimiter-free data is enough to kill a client running with a typical memory_limit.
• Severity (suggested, maintainer to confirm): High — a remote server can reliably crash a connected client over the HTTP/SSE transport.

How input reaches the sink (reachability)

1. A client connects to a server over the HTTP transport by constructing Mcp\Client\Transport\HttpTransport with the server endpoint URL, then runs the connect/request loop.
2. The transport's loop calls tick() (line 182), which calls processSSEStream() (line 194) on each iteration.
3. processSSEStream() reads up to 4096 bytes from the active SSE stream and appends them to $this->sseBuffer (line 203).
4. The buffer is only drained inside the while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) loop (line 207). If the server never emits "\n\n", the strpos never matches, the buffer is never flushed, and it grows on every tick() until OOM.

Vulnerable code

src/Client/Transport/HttpTransport.php (v0.5.0):

    private string $sseBuffer = '';

    private function processSSEStream(): void
    {
        if (null === $this->activeStream) {
            return;
        }

        if (!$this->activeStream->eof()) {
            $chunk = $this->activeStream->read(4096);
            if ('' !== $chunk) {
                $this->sseBuffer .= $chunk;          // line 203 — unbounded append
            }
        }

        while (false !== ($pos = strpos($this->sseBuffer, "\n\n"))) {
            $event = substr($this->sseBuffer, 0, $pos);
            $this->sseBuffer = substr($this->sseBuffer, $pos + 2);

            if (!empty(trim($event))) {
                $this->processSSEEvent($event);
            }
        }

        if ($this->activeStream->eof() && empty($this->sseBuffer)) {
            $this->activeStream = null;
        }
    }

$this->sseBuffer .= $chunk; has no length guard; the drain loop only fires when a "\n\n" delimiter is present.

Proof of concept / End-to-end reproduction (against the released composer package)

Environment: macOS arm64, PHP 8.5.6 (cli), Composer 2.9.8. The package under test is the real published release mcp/sdk v0.5.0 (the version that introduced this HTTP client transport), installed from Packagist — not a re-implementation of the sink.

Install the released package:

$ composer require mcp/sdk:0.5.0 --no-interaction
  - Installing mcp/sdk (v0.5.0): Extracting archive
$ composer show mcp/sdk
name     : mcp/sdk
versions : * v0.5.0

PoC driver (poc_sse.php). It exercises the unmodified released processSSEStream(); the ProbeHttp subclass uses reflection only to inject the active SSE stream and to invoke the inherited private method — no transport logic is overridden. FloodStream is a real PSR-7 StreamInterface that yields a large body (4096 bytes per read()) that never contains "\n\n", mirroring an adversarial SSE server response. The null PSR-18/17 stubs only satisfy the constructor; the sink reads exclusively from the injected stream and never touches the HTTP client: