{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sdk--0.5.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sdk (\u003c= 0.5.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","sse","mcp","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["MCP"],"content_html":"\u003cp\u003eThe \u003ccode\u003emcp/sdk\u003c/code\u003e library, specifically the \u003ccode\u003eHttpTransport\u003c/code\u003e class in version 0.5.0, contains a vulnerability where incoming Server-Sent-Events (SSE) chunks are appended to an internal \u003ccode\u003e$sseBuffer\u003c/code\u003e without any length validation. The implementation relies exclusively on the presence of the \u003ccode\u003e\u0026quot;\\n\\n\u0026quot;\u003c/code\u003e delimiter to flush and clear the buffer. An attacker in control of the remote MCP server endpoint, or an actor capable of performing a man-in-the-middle attack on a plaintext connection, can withhold the required delimiter while streaming arbitrary data. This forces the client to continuously allocate memory to hold the accumulating response, eventually causing the process to reach its PHP \u003ccode\u003ememory_limit\u003c/code\u003e or triggering an OS-level OOM (Out-of-Memory) event. This vulnerability effectively allows a malicious or compromised MCP server to crash any connected client.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim client initializes an \u003ccode\u003eMcp\\Client\\Transport\\HttpTransport\u003c/code\u003e instance to communicate with an adversarial MCP server.\u003c/li\u003e\n\u003cli\u003eThe client initiates an SSE connection to the server endpoint.\u003c/li\u003e\n\u003cli\u003eThe server begins streaming the response but deliberately omits the SSE \u003ccode\u003e\u0026quot;\\n\\n\u0026quot;\u003c/code\u003e event delimiter.\u003c/li\u003e\n\u003cli\u003eThe client's \u003ccode\u003eHttpTransport::processSSEStream()\u003c/code\u003e method is invoked in a loop, reading 4096-byte chunks from the active stream.\u003c/li\u003e\n\u003cli\u003eThe library appends each incoming chunk directly to the private \u003ccode\u003e$sseBuffer\u003c/code\u003e string.\u003c/li\u003e\n\u003cli\u003eBecause the buffer is only flushed upon identifying \u003ccode\u003e\u0026quot;\\n\\n\u0026quot;\u003c/code\u003e via \u003ccode\u003estrpos\u003c/code\u003e, the internal buffer grows monotonically with every network read.\u003c/li\u003e\n\u003cli\u003eThe client process consumes heap memory until exceeding the configured PHP \u003ccode\u003ememory_limit\u003c/code\u003e or system-available RAM.\u003c/li\u003e\n\u003cli\u003eThe client crashes with a fatal memory exhaustion error, resulting in a successful denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the immediate denial-of-service of the client process. Any system or application relying on the \u003ccode\u003emcp/sdk\u003c/code\u003e client is vulnerable to process crashes initiated by a malicious remote peer. This can lead to significant service disruption, especially in automated environments where the client is expected to maintain long-running connections to MCP servers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of \u003ccode\u003emcp/sdk\u003c/code\u003e that implements a hard limit on the SSE buffer size.\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not available, implement a wrapper or middleware to monitor memory usage for MCP client processes and proactively terminate connections that exhibit anomalous memory growth.\u003c/li\u003e\n\u003cli\u003eEnsure that all MCP connections are configured to use TLS to prevent man-in-the-middle injection of malicious SSE streams.\u003c/li\u003e\n\u003cli\u003eReview and tighten the \u003ccode\u003ememory_limit\u003c/code\u003e configuration for PHP processes interacting with untrusted external servers to limit the impact of such memory-based exhaustion attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:34:05Z","date_published":"2026-08-19T22:34:05Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mcp-sdk-sse-dos/","summary":"The MCP PHP SDK's HTTP transport fails to bound the in-memory buffer used for Server-Sent-Events, allowing a malicious server to trigger a denial-of-service via memory exhaustion.","title":"Unbounded Memory Growth in MCP PHP SDK SSE Client","url":"https://feed.craftedsignal.io/briefs/2026-08-mcp-sdk-sse-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Sdk (\u003c= 0.5.0)","version":"https://jsonfeed.org/version/1.1"}