Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

PKSA-p9gd-j6gr-6f9t CVE-2026-53965

Affected package: mcp/sdk

Affected version: >=0.5.0,<0.7.1

Reported by:
FriendsOfPHP/security-advisories