Security · High impactFan score 68 · Tier A
How to check for Go MPTCP listeners and turn them off
DEV · By ImportStatic ·
The Brief
- Turning off Multipath TCP in a Go server removes the condition the published exploit for CVE-2026-98432 needs.
- Disabling MPTCP does not fix the underlying kernel bug.
- Anthropic described the exploit on October 27 as zero-click remote code execution.
Why it matters
Developers running Go servers with MPTCP listeners can reduce their exposure to the published exploit by turning MPTCP off while the kernel bug remains unfixed.
Who’s affected
- Teams running Go servers with MPTCP listeners
What to do
- Check Go servers for MPTCP listeners
- Turn off Multipath TCP on affected Go servers
- CVE-2026-98432
- #go
- #mptcp
- #security
- #vulnerability
- #networking
Originally published on ImportStatic . Turning off Multipath TCP in a Go server removes the condition the published exploit for CVE-2026-98432 needs, but it leaves the kernel bug in place. Anthropic described that exploit on October 27 as zero-click remote code execution against…
Timeline
Anthropic describes the published exploit for CVE-2026-98432 as zero-click remote code execution
DEV Community: backend
How to check for Go MPTCP listeners and turn them off