This advisory covers two security flaws in Python 3.11 as distributed by Red Hat. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that could allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API, which also permits arbitrary code execution. Both vulnerabilities are addressed in updated python3.11 packages for Red Hat Enterprise Linux 9.2 and its variants. The advisory references Red Hat Bugzilla entries and provides package updates for multiple architectures. No CVSS base score is provided, but the impact is considered important by Red Hat.

Successful exploitation of CVE-2026-6100 may result in arbitrary code execution or information disclosure due to a use-after-free condition in decompression modules. CVE-2026-4786 allows arbitrary code execution via command injection in the webbrowser.open() API. Both vulnerabilities could lead to compromise of affected systems running the vulnerable Python versions. The advisory rates the security impact as important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 9.2 and related variants that address these vulnerabilities. Users should apply the provided security updates as described in the Red Hat advisory RHSA-2026:13692 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.