alt Hacker NewsThis is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.
1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
Replies
philipwhiuk • today at 12:12 PM
*Since Go 1.24
ForHackernews • today at 12:36 PM
Does this mean Caddy is vulnerable? IIRC, I think it's written in Go.
Eueudhsbsj32 • today at 9:30 AM
But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).
➕ show 1 reply
the default on all of my RHEL is to have it disabled, I believe it's the same on Debian based
sysctl -a | grep net.mptcp.enabled net.mptcp.enabled = 0
and golang apps would just gracefully downgrade to non mptcp in that case.