This advisory covers two security flaws in Python 3.11 as packaged by Red Hat for their Enterprise Linux 9.4 Extended Update Support. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that could allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API, enabling arbitrary code execution. Red Hat has released updated python3.11 packages to address these issues. The advisory includes detailed package versions and references for remediation.

Successful exploitation of CVE-2026-6100 could result in arbitrary code execution or information disclosure due to a use-after-free condition in decompression modules. CVE-2026-4786 allows arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose a high risk to affected systems running vulnerable Python versions, potentially allowing attackers to execute malicious code or access sensitive information.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:14653 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.