Upstream Sync Report 2026-08-19: Go 1.26.6 security fixes and HTTP/2 follow-up

[imroc]

Upstream Sync Report — 2026-08-19

Upstream changes

• Go stdlib net/http: 9689556 (2026-08-17) clears ReadHeaderTimeout after accepting an unencrypted HTTP/2 connection. The change is server-side (server.go and stdlib's internal HTTP/2 server), while req inlines client-side net/http code, so no req port is required.
• golang.org/x/net/http2: f6c404b (2026-08-17) restores documentation for h2c.NewHandler. req does not vendor h2c, so no action is required.
• quic-go: no release or security advisory after v0.61.0.

Security scan

govulncheck ./... with the local Go 1.26.5 toolchain reports five standard-library advisories fixed in Go 1.26.6:

Advisory	CVE	Affected area	req call path
GO-2026-6218	CVE-2026-56860	net/url	Client.Do → URL parsing
GO-2026-6090	CVE-2026-56862	crypto/tls	HTTP/2/HTTP/3 TLS paths
GO-2026-6088	CVE-2026-56859	encoding/xml	Response.UnmarshalXml
GO-2026-5972	CVE-2026-33818	encoding/asn1	certificate loading
GO-2026-5026	CVE-2026-39821	x/net/idna	Client.Do via net/http

These are toolchain-level vulnerabilities rather than defects introduced by req source. The already required golang.org/x/net version v0.58.0 contains the x/net fix for GO-2026-5026. Users should build req with a patched Go toolchain (1.25.13+ on the 1.25 line or 1.26.6+ on the 1.26 line).

Impact

• No change to req's modified net/http, internal/http2/, or internal/http3/ files is required.
• The upstream baselines have advanced to Go 9689556 and x/net/http2 f6c404b.
• quic-go remains at v0.61.0; the inlined HTTP/3 code still needs a manual sync from v0.60.0 to v0.61.0.

Recommended action

No source change is needed for this report. Consumers should use a patched Go toolchain; maintainers should continue the existing manual HTTP/3 sync tracked in #502.