Go's net/http default client has no timeout — always construct an http.Client with an explicit Timeout before calling external services.

A service using http.Get(url) to call an upstream embedding API hung indefinitely when the upstream went silent (TCP established, no bytes). goroutines piled up until the process OOM'd after ~20 minutes. Switching to &http.Client{Timeout: 10 * time.Second} aborted the stuck calls cleanly. The stdlib default is 0 which means no timeout, despite what many tutorials imply.

Any Go service making outbound HTTP calls in production. Applies to all Go versions including 1.25.