This vulnerability involves a use-after-free condition in CPython's decompression modules (lzma, bz2, gzip) when a decompressor instance is reused after a MemoryError caused by memory allocation failure. The flaw arises specifically if the same decompressor instance is reused across multiple decompression calls after such an error, leading to a dangling pointer and potential arbitrary code execution or information disclosure. One-shot decompression functions that create new decompressor instances per call are not affected. Red Hat has issued updated container images with backported fixes to address this issue.

The vulnerability allows for arbitrary code execution or information disclosure via use-after-free in decompression modules under specific conditions of memory pressure and decompressor instance reuse after a MemoryError. The CVSS 4.0 score is 9.1 (critical), indicating high impact with network attack vector, high complexity, and potential for privilege escalation and high confidentiality and integrity impact.

Red Hat has released updated RHEL-8 based Middleware Containers container images that include backported patches fixing this vulnerability. Users are advised to upgrade to these updated images and rebuild any dependent container images. No other mitigation is specified or required if these updated images are used. Patch status is confirmed via Red Hat advisory; a fix is available through updated container images.