This advisory covers two security flaws in python3 as packaged by Red Hat for RHEL 8.4 AUS and EUS. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can result in arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could allow arbitrary code execution. Red Hat has released updated python3 packages to fix these issues. The advisory references Red Hat Bugzilla entries and provides package updates for multiple python3-related packages. No CVSS scores are provided in the advisory, but the impact is rated Important by Red Hat Product Security.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose information due to a use-after-free flaw in decompression modules. CVE-2026-4786 could enable arbitrary code execution via command injection through the webbrowser.open() API. Both vulnerabilities pose a high risk to systems running affected python3 packages, potentially compromising system integrity or confidentiality.

Red Hat has released updated python3 packages for Red Hat Enterprise Linux 8.4 AUS and EUS to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:19590 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.