From 70d5aeafd1e70d94f59f1a2dba54696f5db7a936 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Trivino Date: Sun, 1 Nov 2026 23:36:06 +0100 Subject: [PATCH] fix: disable Multipath TCP by default to mitigate CVE-2026-98432 Go enables MPTCP on listen sockets by default since Go 1.24. Set the multipathtcp GODEBUG to 0 in the main module so that all Chainloop binaries (control plane, artifact CAS, CLI and plugins) stop opening MPTCP listeners, as recommended by the Go Security Team. Refs: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw Refs: https://go.dev/issue/82717 Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino Chainloop-Trace-Sessions: b1cc868a-f144-4b5d-90eb-1d3e77b9ad70 Signed-off-by: Miguel Martinez Trivino --- go.mod | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/go.mod b/go.mod index f8471309b..ca6c3f8d1 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,10 @@ module github.com/chainloop-dev/chainloop go 1.27.3 +// Disable Multipath TCP by default on listen sockets (on since Go 1.24). +// Mitigation for CVE-2026-98432, see https://go.dev/issue/82717 +godebug multipathtcp=0 + require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 buf.build/go/protovalidate v1.4.0