This Red Hat security advisory addresses two vulnerabilities in python3.9: CVE-2026-6100, a use-after-free vulnerability in decompression modules that may allow arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. The vulnerabilities affect Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions and related packages on various architectures including aarch64 and ppc64le. Red Hat has released updated python3.9 packages to fix these issues. The advisory does not provide CVSS scores but classifies the impact as Important. No exploits are currently known in the wild.

Successful exploitation of CVE-2026-6100 could result in arbitrary code execution or information disclosure due to a use-after-free flaw in decompression modules. CVE-2026-4786 could allow arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose significant security risks to affected systems running vulnerable python3.9 versions on Red Hat Enterprise Linux 9.0 and related variants. No known active exploitation has been reported.

Red Hat has released updated python3.9 packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:19571 and the referenced article https://access.redhat.com/articles/11258. Since this is an official Red Hat security advisory with available patches, applying the update is the recommended remediation. There are no indications that additional mitigation steps are required beyond applying the update.