diff --git a/NOTICE b/NOTICE
index 5d56a56940..a91d7c8659 100644
--- a/NOTICE
+++ b/NOTICE
@@ -5164,9 +5164,9 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 -----------------------------------------------------------------------------
 
 Package:  golang.org/x/net
-Version:  v0.61.0
+Version:  v0.62.0
 License:  BSD-3-Clause
-Source:   https://cs.opensource.google/go/x/net/+/v0.61.0:LICENSE
+Source:   https://cs.opensource.google/go/x/net/+/v0.62.0:LICENSE
 
 Copyright 2009 The Go Authors.
 
diff --git a/changelog.d/security-govulncheck-xnet.md b/changelog.d/security-govulncheck-xnet.md
new file mode 100644
index 0000000000..45b5a2ce36
--- /dev/null
+++ b/changelog.d/security-govulncheck-xnet.md
@@ -0,0 +1 @@
+- Bump golang.org/x/net to v0.62.0 to clear GO-2026-6860 (govulncheck).
diff --git a/src/go.mod b/src/go.mod
index ce8024a8bf..db31907c8e 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -75,7 +75,7 @@ require (
 	go.uber.org/automaxprocs v1.6.0
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
-	golang.org/x/net v0.61.0
+	golang.org/x/net v0.62.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/text v0.43.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
diff --git a/src/go.sum b/src/go.sum
index 80064092dd..50241e6bf5 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -145,8 +145,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=