Go net/http 1.26

Apply the Go 1.26 baseline first. These rules cover servers, clients, routers, reverse proxies, and browser-facing handlers built with the Go 1.26 net/http standard library. net/http and net/http/httputil ship inside the Go toolchain, so their fixes reach an application only when it is rebuilt and redeployed with a newer Go 1.26 release, never by raising a module requirement. The standard library carries its own copy of the HTTP/2 code; if the application also imports golang.org/x/net/http2 or golang.org/x/net/http2/h2c directly, that copy comes from the golang.org/x/net module and needs its own upgrade.

Server and protocol boundaries

• Attach a dedicated http.NewServeMux to each configured http.Server. Package-level serving shortcuts create a server with default limits, and a nil Server.Handler exposes DefaultServeMux, including handlers registered by imports such as net/http/pprof.
• Enforce header counts at the ingress before Go parses them. Go 1.26 has no Server.MaxHeaderValueCount; a handler count check limits downstream work but cannot prevent initial parser allocations. Keep the baseline's MaxHeaderBytes budget as well.
• Select Server.Protocols and Transport.Protocols explicitly when protocol choice affects security. Keep unencrypted HTTP/2 behind an authenticated, integrity-protected channel. Check the negotiated protocol after changing ALPN, TLSNextProto, or transport dial/TLS hooks; custom transport hooks can disable automatic HTTP/2 unless explicitly enabled.
• Set Server.HTTP2.MaxConcurrentStreams per connection and