golang A field note by Vikrant Sharma
Go turned on multipath TCP and now half the internet is vulnerable
Go 1.24 silently enabled MPTCP by default. Every Go binary now hits a Linux kernel vulnerability that lets attackers hijack TCP streams.
Go 1.24 shipped with multipath TCP enabled by default. No announcement. No migration guide. Just a quiet flip in the networking stack that now exposes every Go program to CVE-2026-98432, a Linux kernel bug that lets attackers inject packets into established TCP connections.
MPTCP is meant to improve performance by letting a single connection use multiple network paths. Your phone switches between WiFi and cellular without dropping the socket. Data centres bond multiple links. Great idea in theory.
The problem is the Linux kernel implementation before 6.12.8 has a state machine bug. An attacker who can observe your traffic can forge subflow control packets and hijack the stream. The Go team assumed MPTCP was stable because it shipped in the kernel years ago. They did not check if the implementation was actually safe.
This is not a Go bug. The kernel is broken. But Go is the only major runtime that enables MPTCP without asking. Rust does not. Python does not. Node does not. Every HTTP server written in Go since April is now sitting with a network stack that trusts kernel code most developers have never heard of.
The fix is environment variable GODEBUG=multipathtcp=0 or upgrade to Go 1.24.3, which reverts the default. Kubernetes clusters running old kernels are the biggest target. An attacker on the same network can intercept API server traffic and inject commands.
I learned this exists because someone on Hacker News asked why their firewall logs suddenly showed MPTCP handshake failures. The answer is Go changed a default and nobody noticed until production broke. Defaults matter. Especially in networking.
Source: Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432