> running any sort of Go server like Caddy

It's so much worse than this, and there is a staggering amount of misinformation running rampant about this bug.

MPTCP is not a requirement, it can be exploited merely by sending specially crafted TCP packets with (any) IP options set. No special MPTCP support, web servers or any specific software listeners are even necessary at all to trigger it, just send the packets and boom.

I think the reason people assume MPTCP is a requirement is because that's what the PoC used... but MPTCP itself also doesn't even rely solely on IP options.

Ubuntu also does not even list a single mitigation strategy... at least RHEL did.

And like I said, any normal TCP packet that contains IP (not TCP) options can trigger the bug. I cannot emphasize enough how important and absolutely ridiculous this is.

Like the post says, this is big enough to get a massive amount of people to completely stop trusting Ubuntu entirely and jump ship.