The vulnerabilities fixed in python-pytest-html stem from issues in the browserslist package. CVE-2026-73088 is a prototype pollution vulnerability caused by an unguarded for...in loop over untrusted JSON keys in the normalizeStats() function, which can cause uncaught exceptions and denial of service. CVE-2026-73089 is an unbounded in-memory caching issue of query pairs in browserslist(), which can be exploited to cause memory exhaustion and denial of service. The Red Hat advisory highlights that these flaws allow remote attackers to cause application crashes and service unavailability without requiring authentication or user interaction. The recommended mitigation is to ensure browserslist processes only trusted statistics data and to apply the security update provided by SUSE and Red Hat.

These vulnerabilities can lead to denial of service conditions by crashing applications or exhausting memory resources. The prototype pollution flaw (CVE-2026-73088) can cause applications using browserslist to crash unexpectedly, impacting availability. The unbounded caching issue (CVE-2026-73089) can be exploited to consume excessive memory, also resulting in denial of service. Both vulnerabilities can be triggered remotely without authentication, increasing their risk. No confidentiality or integrity impacts are reported.

Apply the security update for python-pytest-html that includes the fixed browserslist version. Additionally, ensure that browserslist processes only trusted input data such as browserslist-stats.json, opts.stats, and CLI --stats data. Avoid using browserslist with untrusted input sources in development or build environments. Validate that any automated pipelines feeding data into browserslist only use trusted sources. No vendor advisory indicates that no action is required; therefore, these mitigations are necessary.