This is a backport CL for the equivalent change in std.

Fixes CVE-2026-97032
Fixes golang/go#81867

Change-Id: I8eaacd659f5d357b32699b63f726c4356a6a6964
Reviewed-on: https://go-review.googlesource.com/c/net/+/847188
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>