This advisory covers two security flaws in python3.9 packages for Red Hat Enterprise Linux 9. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that may allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. Red Hat has issued patches for these vulnerabilities as part of an important security update. The advisory references Red Hat's errata RHSA-2026:10949 and provides package updates for multiple architectures and variants of Red Hat Enterprise Linux 9 and CodeReady Linux Builder 9.

Successful exploitation of CVE-2026-6100 could result in arbitrary code execution or information disclosure due to a use-after-free flaw in decompression modules. CVE-2026-4786 could allow arbitrary code execution via command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk, potentially allowing attackers to execute malicious code or access sensitive information on affected systems running vulnerable python3.9 versions.

Red Hat has released updated python3.9 packages that address these vulnerabilities. Users should apply the security update available for Red Hat Enterprise Linux 9 and related CodeReady Linux Builder 9 packages as described in Red Hat advisory RHSA-2026:10949. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated by the vendor beyond applying the official patches.