This advisory covers two security flaws in python3.11 as packaged by Red Hat for Enterprise Linux 9. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can result in arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that allows arbitrary code execution. Red Hat has released updated python3.11 packages to address these vulnerabilities. The advisory references Red Hat Bugzilla entries BZ-2457932 and BZ-2458049 for the respective CVEs. The affected products include multiple architectures and variants of Red Hat Enterprise Linux 9 and CodeReady Linux Builder 9. No CVSS base scores are provided in the advisory or CVE records.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free flaw in decompression modules. CVE-2026-4786 could enable arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk as they allow remote or local attackers to execute code with the privileges of the Python process. The advisory rates the update as important, indicating significant impact but not critical severity.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 9 and related variants that fix these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory RHSA-2026:10774 and the article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.