Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:

ss -Mln

running the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.

What? EEVEE is evolving!
EEVEE evolved into RAYTHEON!

Ah yes, China’s and India’s rivalry over supremacy over East Asia wasn’t enough. Now they can have KSA and Iran fighting over the Middle East, plus Egypt and Ethiopia ready to go to war over a dam, under the same banner. I guess if half the members of a consortium want to murder the other half it balances out?