CVE-2026-53965
1 advisory.
Packagist/mcp/sdk CVE-2026-53965: high, EPSS 0.61%
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Action: Upgrade mcp/sdk to 0.7.1 or later.
composer require mcp/sdk:0.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.0 | 0.7.1 | - |
Fixed versions
| 0.7.1 |
Sources
- osv: GHSA-7m52-jw36-44r3
- https://github.com/modelcontextprotocol/php-sdk/security/advisories/GHSA-7m52-jw36-44r3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mcp/sdk/CVE-2026-53965.yaml
- https://github.com/modelcontextprotocol/php-sdk
- https://github.com/modelcontextprotocol/php-sdk/releases/tag/v0.7.1
CVE-2026-53965 · published · modified · JSON