Cloudflare have already deployed WAF managed rules to help mitigate the vuln: https://x.com/dok2001/status/2112811965735202970
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.