Red Hat Product Security issued an important security advisory (RHSA-2026:19590) for python3 packages in Red Hat Enterprise Linux 8.4 addressing two vulnerabilities: CVE-2026-6100, a use-after-free in decompression modules leading to arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API allowing arbitrary code execution. The advisory provides updated python3 packages to fix these issues. The CVSS vector for CVE-2026-4786 indicates a local attack vector with low complexity, partial user interaction, and high impact on confidentiality and integrity. The vulnerabilities affect python3 as distributed in Red Hat Enterprise Linux 8.4 AppStream AUS, BaseOS AUS, and EUS Extension variants. The advisory references Red Hat's official update article for applying the fixes.

Successful exploitation of CVE-2026-6100 can result in arbitrary code execution or information disclosure due to a use-after-free vulnerability in decompression modules. CVE-2026-4786 allows an attacker to execute arbitrary code via command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk by potentially allowing attackers to execute code with the privileges of the affected python3 process, leading to compromise of system confidentiality and integrity.

Red Hat has released updated python3 packages for Red Hat Enterprise Linux 8.4 variants that address these vulnerabilities. Users should apply the official Red Hat updates as described in the advisory RHSA-2026:19590 and the referenced update article (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the provided patches.