From 0fdb276fb7a7e9524d6fdf4d362ec007504aa05e Mon Sep 17 00:00:00 2001
From: Fangliding <Fangliding.fshxy@outlook.com>
Date: Fri, 30 Oct 2026 04:13:11 +0800
Subject: [PATCH] Disable default MPTCP listener

---
 transport/internet/system_listener.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/transport/internet/system_listener.go b/transport/internet/system_listener.go
index 1999953eb..08ab4c18d 100644
--- a/transport/internet/system_listener.go
+++ b/transport/internet/system_listener.go
@@ -89,6 +89,9 @@ func (dl *DefaultListener) Listen(ctx context.Context, addr net.Addr, sockopt *S
 		lc.Control = getControlFunc(ctx, sockopt, dl.controllers)
 		// default disable keepalive
 		lc.KeepAlive = -1
+		// MPTCP is enabled by default golang listener
+		// due to CVE-2026-98432, MPTCP should be disabled by default
+		lc.SetMultipathTCP(false)
 		if sockopt != nil {
 			if sockopt.TcpKeepAliveIdle*sockopt.TcpKeepAliveInterval < 0 {
 				return nil, errors.New("invalid TcpKeepAliveIdle or TcpKeepAliveInterval value: ", sockopt.TcpKeepAliveIdle, " ", sockopt.TcpKeepAliveInterval)