This Red Hat security advisory (RHSA-2026:19571) addresses two vulnerabilities in python3.9. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can lead to arbitrary code execution or information disclosure. CVE-2026-4786 is an arbitrary code execution vulnerability caused by command injection in the webbrowser.open() API. The advisory applies to Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (aarch64, ppc64le, s390x, x86_64). Red Hat has released updated python3.9 packages (version 3.9.10-4.el9_0.11) to fix these issues. The advisory rates the security impact as Important but does not provide CVSS scores. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free flaw in decompression modules. CVE-2026-4786 could allow arbitrary code execution via command injection through the webbrowser.open() API. Both vulnerabilities pose a high security risk as they enable remote code execution or data leakage. The advisory rates the impact as Important, indicating significant security concerns that warrant prompt remediation.

Red Hat has released updated python3.9 packages for Red Hat Enterprise Linux 9.0 that address these vulnerabilities. Users should apply the provided security updates as described in the Red Hat advisory RHSA-2026:19571 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations or workarounds are specified. Applying the official update is the recommended remediation.