MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
The HTTP client transport in mcp/sdk reads a Server-Sent-Events (SSE) response stream incrementally and appends each 4 KiB chunk to an in-memory buffer ($this->sseBuffer .= $chunk;) with no upper bound. The buffer is only ever flushed when an SSE event delimiter ("\n\n") appears. A remote MCP server (the peer the client connects to) that streams response bytes without ever sending the "\n\n" delimiter makes $sseBuffer grow without limit until the …