This advisory covers two security vulnerabilities in python3 on Red Hat Enterprise Linux 8.4. CVE-2026-6100 involves a use-after-free flaw in decompression modules that may allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. Red Hat has released updated python3 packages to address these issues. The vulnerabilities are classified under CWE-88 (Injection) and CWE-825 (Use After Free). No CVSS scores are provided in the advisory, but the severity is rated as important (high).

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free vulnerability in decompression modules. CVE-2026-4786 could enable arbitrary code execution through command injection in the webbrowser.open() API. These impacts could compromise system integrity and confidentiality on affected Red Hat Enterprise Linux 8.4 systems running vulnerable python3 versions. There are no known active exploits in the wild.

Red Hat has released updated python3 packages for Red Hat Enterprise Linux 8.4 that address these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2026:19590 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as fixed by the vendor. No additional mitigation steps are indicated by Red Hat.