Cloudflare have already deployed WAF managed rules to help mitigate the vuln: https://x.com/dok2001/status/2112811965735202970

But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.

A WAF can block known _exploits_ it doesn't prevent the vulnerability from being abused by a new / other / slightly changed exploit.