security: fix CVE-2026-33818

[thatnealpatel]

This is a PRIVATE issue for CVE-2026-33818, tracked in http://b/499330550.

[thatnealpatel]

Hi @gopherbot, please open backport issues for this security issue.

[gopherbot]

Backport issue(s) opened: #80768 (for 1.25), #80769 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.