Hacker News Reader

Comment by reissbaker | Hacker News Reader

This is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.

1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw

View on HN

the default on all of my RHEL is to have it disabled, I believe it's the same on Debian based

sysctl -a | grep net.mptcp.enabled net.mptcp.enabled = 0

and golang apps would just gracefully downgrade to non mptcp in that case.

> I believe it's the same on Debian based

"sysctl -a | grep net.mptcp.enabled" gives "net.mptcp.enabled = 1" on Debian 13 (Trixie). That's a non-server desktop install fwiw.

Edit - security advisory is here: (dated Oct 16) https://lists.debian.org/debian-security-announce/2026/msg00...

Does this mean Caddy is vulnerable? IIRC, I think it's written in Go.

*Since Go 1.24

But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).

> MPTCP port blocked

MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.

MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.

Firewalls do not operate at layer 7 nor do TLS termination.

What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).

But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.

fnord

A request from authority isn’t a counter argument. And it doesn’t mean your opinions about this attack were correct.

Congratulations on knowing what a bastion server is though. But that’s extremely common knowledge and doesn’t prove your point either.

Perhaps you can share how a layer 7 inspection tool might mitigate a layer 4 attack an actual networking terms?

Wait. So; just because you've studied with someone makes your opinion correct? Damn. I wish I would have known that long ago! In both my education tracts of medicine and CS, I've studied with some pretty great minds and I could have been passing off my opinion as fact for decades now.

I wish I would have received that memo. </sarcasm>

Firewalls can operate at Layer 7, too. The “F” in “WAF” stands for “firewall.”

Bwahahah!

Attorneys can operate as a firewall too: if they sit in a building with a firewall.

I thought it stood for "false positives"?

i always thought it was "What the Actual F**"

Reply on news.ycombinator.com