Looks like Mullvad is not really affected: https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/