This advisory covers two security issues in Python 3.11 as packaged by Red Hat. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that may allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could enable arbitrary code execution. The vulnerabilities affect various Red Hat Enterprise Linux 9.6 Extended Update Support and CodeReady Linux Builder products across multiple architectures. Red Hat has released updated python3.11 packages to address these flaws. The advisory references Red Hat Bugzilla entries BZ-2457932 and BZ-2458049 for the respective CVEs. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.

Successful exploitation of CVE-2026-6100 could result in arbitrary code execution or information disclosure due to a use-after-free condition in decompression modules. CVE-2026-4786 could allow arbitrary code execution through command injection in the webbrowser.open() API. These impacts could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Python versions. No known exploits in the wild have been reported, but the vulnerabilities present a high risk if exploited.

Red Hat has released updated python3.11 packages for affected Red Hat Enterprise Linux 9.6 Extended Update Support and related products. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the issues described. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.