This advisory covers two vulnerabilities in Python 3.9 as packaged for Red Hat Enterprise Linux 9.6 EUS. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that may allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. Red Hat has issued updated python3.9 packages (version 3.9.21-2.el9_6.6) to fix these issues. The advisory references bugzilla entries BZ-2457932 and BZ-2458049 for the respective CVEs. The vulnerabilities are rated as Important by Red Hat, but no CVSS base scores are provided. The affected products include multiple Red Hat Enterprise Linux 9.6 Extended Update Support variants and Red Hat CodeReady Linux Builder 9.6 EUS.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free condition in decompression modules. Exploitation of CVE-2026-4786 could allow arbitrary code execution via command injection through the webbrowser.open() API. Both vulnerabilities pose a high security risk by enabling remote or local attackers to execute code with the privileges of the Python process.

Red Hat has released updated python3.9 packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:19576 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch.