[HIGH] Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

PKSA-p9gd-j6gr-6f9t CVE-2026-53965 GHSA-7m52-jw36-44r3

Affected package: mcp/sdk

Affected version: >=0.5.0,<0.7.1

Reported by:
GitHub, FriendsOfPHP/security-advisories