security: fix CVE-2024-45341

[rolandshoemaker]

This is a PRIVATE issue for CVE-2024-45341, tracked in http://b/379881511 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/1700.

/cc @golang/security and @golang/release

[neild]

@gopherbot please open backport issues for 1.22, 1.23, and 1.24

[gopherbot]

Backport issue(s) opened: #71207 (for 1.22), #71208 (for 1.23), #71209 (for 1.24).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.