Disable default MPTCP listener

.github/workflows/cleanup-dangling-images.yml

@@ -1,26 +0,0 @@
-name: Cleanup dangling container images
-
-on:
-  push:
-    branches:
-      - bulk-cleanup-ghcr
-
-# Run the two cleanup workflows one at a time.
-concurrency:
-  group: ghcr-images
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    permissions:
-      packages: write
-    steps:
-      # Untagged architecture manifests can still belong to a tagged image.
-      - name: Delete untagged and unreferenced versions
-        uses: dataaxiom/ghcr-cleanup-action@v1.2.2
-        with:
-          package: xray-core
-          delete-untagged: true
-          dry-run: true

.github/workflows/cleanup-sha-images.yml

@@ -1,30 +0,0 @@
-name: Cleanup sha- container images
-
-on:
-  push:
-    branches:
-      - bulk-cleanup-ghcr
-
-# Run the two cleanup workflows one at a time.
-concurrency:
-  group: ghcr-images
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    permissions:
-      packages: write
-    steps:
-      # The repository needs Admin access under the package's Manage Actions access.
-      - name: Delete versions with only sha- tags
-        uses: dataaxiom/ghcr-cleanup-action@v1.2.2
-        with:
-          package: xray-core
-          use-regex: true
-          delete-tags: '^sha-'
-          # Preserve every non-sha- tag. The colon check avoids matching digests.
-          exclude-tags: '^(?!sha-)[^:]+$'
-          delete-untagged: false
-          dry-run: true

transport/internet/system_listener.go

@@ -89,6 +89,9 @@ func (dl *DefaultListener) Listen(ctx context.Context, addr net.Addr, sockopt *S
 		lc.Control = getControlFunc(ctx, sockopt, dl.controllers)
 		// default disable keepalive
 		lc.KeepAlive = -1
+		// MPTCP is enabled by default golang listener
+		// due to CVE-2026-98432, MPTCP should be disabled by default
+		lc.SetMultipathTCP(false)
 		if sockopt != nil {
 			if sockopt.TcpKeepAliveIdle*sockopt.TcpKeepAliveInterval < 0 {
 				return nil, errors.New("invalid TcpKeepAliveIdle or TcpKeepAliveInterval value: ", sockopt.TcpKeepAliveIdle, " ", sockopt.TcpKeepAliveInterval)