Red Hat Product Security issued an advisory (RHSA-2026:11062) for python3.11 on Red Hat Enterprise Linux 8 addressing two vulnerabilities: CVE-2026-6100, a use-after-free in decompression modules enabling arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API allowing arbitrary code execution. These vulnerabilities affect multiple architectures and variants of Red Hat Enterprise Linux 8 and CodeReady Linux Builder. The advisory provides updated packages to remediate these issues. No CVSS scores are provided in the advisory, but the severity is rated as important. The vendor advisory includes detailed package information and instructions for applying the update.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free vulnerability in decompression modules. CVE-2026-4786 could enable arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk by potentially allowing attackers to gain control over affected systems or access confidential data. No known exploits in the wild have been reported, but the impact of these vulnerabilities is significant given the nature of arbitrary code execution.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:11062 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix from the vendor, applying the update is the recommended and effective mitigation. No additional mitigations are specified or required beyond applying the vendor-provided patch.