Go net/http EUVD-2026-58510

The primary fix is to upgrade Go to a patched release: 1.25.13, 1.26.6, or 1.27.0-rc.3 or later within each respective train, as confirmed by the Go vulnerability database at pkg.go.dev/vuln/GO-2026-6089 and the golang-announce mailing list (groups.google.com/g/golang-announce/c/94pEornpRlI). The upstream fix is tracked at go.dev/cl/795540. If an immediate upgrade is not feasible, the most effective compensating control is to disable h2c entirely and serve HTTP/2 exclusively over TLS, which removes the vulnerable preface-detection code path with no functional loss for most production architectures. If h2c is operationally required (e.g., for cleartext gRPC between internal services), place a reverse proxy or load balancer in front of the Go service that enforces its own connection and header timeouts, effectively rate-limiting or timing out slow connections before they reach the Go process. Note that this proxy-based workaround shifts the trust boundary and introduces an additional network hop; it does not fix the underlying code defect. Network-level mitigations such as firewall rules restricting h2c port access to known client ranges can further reduce exposure surface in private deployments.