The vulnerability CVE-2026-6100 is a use-after-free (CWE-416) in Python's decompression modules (lzma.LZMADecompressor, bz2.BZ2Decompressor, gzip.GzipFile) triggered when a decompression instance is re-used after a MemoryError caused by memory allocation failure under memory pressure. This can lead to arbitrary code execution or information disclosure. The flaw is specific to re-using decompressor instances after an error; one-shot decompression functions that create new instances per call are not vulnerable. Red Hat's advisory highlights that the vulnerability's impact is somewhat mitigated by default process privilege restrictions on their platforms. Red Hat has released updated RHEL-8 based Middleware Containers images with backported patches to address this issue. No alternative mitigations meeting Red Hat's criteria are currently available. The CVSS 4.0 base score is 9.1 (critical), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an attacker to execute arbitrary code or disclose sensitive information by exploiting a use-after-free condition in Python decompression modules when re-using decompressor instances after a MemoryError. The impact is critical, affecting confidentiality, integrity, and availability. However, on Red Hat platforms, the impact is somewhat mitigated by default non-root process privileges and scope limitations. The vulnerability does not affect one-shot decompression helper functions or cases where decompressor instances are not re-used after errors.

Red Hat has released updated RHEL-8 based Middleware Containers container images containing backported patches that fix this vulnerability. Users are advised to upgrade to these updated images and rebuild dependent container images. No other mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Avoid re-using decompressor instances after a MemoryError as a best practice until patches are applied.