The https://tunnelcrack.mathyvanhoef.com/details.html references Mozilla VPN, Surfshark, Malwarebytes, Windscribe, Cloudflare. Maybe I'm reading more into that than is intended but it says explicitly they worked with these vendors and produced a patch
If others are taking the approach that no further action is necessary and Palo Alto does the same, I suppose we'll have to live with it but its odd, in my opinion, for a vendor to throw up their hands and say, "Sorry, you'll have to live with this."
Full excerpt below:
To protect users, security updates were prepared during a 90-days coordinated disclosure in collaboration with CERT/CC and various VPN vendors. Some example patched VPNs are Mozilla VPN, Surfshark, Malwarebytes, Windscribe (can import OpenVPN profiles), and Cloudflare's WARP. If updates for your VPN are not available, you can mitigate the LocalNet attack by disabling local network access. You can also mitigate attacks by assuring websites use HTTPS, which many websites nowadays support.
... View more
