When parsing a URL-encoded form net/http may allocate an unexpected amount of
memory when provided a large number of key-value pairs. This can result in a
denial of service due to memory exhaustion.

Thanks to jub0bs for reporting this issue.

This is CVE-2025-61726 and Go issue https://go.dev/issue/77101.

This is a PRIVATE issue for CVE-2025-61726, tracked in http://b/457464435 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3020.

/cc @golang/security and @golang/release