CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).

▲

vbezhenar 3 hours ago | parent [-]

Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.

Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.

	▲	ASalazarMX 2 hours ago \| parent \| next [-]
		But they have very valid point: a CVE 10.0 with root RCE on twenty internal servers is lower risk than one vulnerable internet-facing server. All need to be patched, but the one on the Internet is your critical risk, the others are medium at worse.
	▲	cpncrunch an hour ago \| parent \| prev [-]
		It's trivially easy to disable multipath in Go.