This advisory covers two security flaws in Python 3.11 as packaged by Red Hat. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can result in arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that allows arbitrary code execution. The vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related builds. Red Hat has released updated python3.11 packages to fix these issues. The advisory references bugzilla entries BZ-2457932 and BZ-2458049 for the fixes. No CVSS scores are provided in the advisory.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code or disclose sensitive information on affected systems running vulnerable Python 3.11 versions. This could compromise system integrity and confidentiality. The issues affect decompression modules and the webbrowser.open() API, both potentially exploitable vectors for remote or local attackers depending on context.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related products that address these vulnerabilities. Users should apply these official updates as soon as possible. For detailed update instructions, refer to Red Hat's article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated in the advisory.