Denial of service via unbounded parsing and rescanning

Denial of service in JustHTML before 1.18.0 allows attackers to exhaust CPU or memory through crafted selectors or linkification input. Selector parsing and matching repeatedly rescan large trees, token lists, siblings, ancestors, and text without structural or work budgets, while cyclic DOM graphs can prevent traversal from terminating and Linkify repeatedly rescans punctuation-heavy text. Exposure requires an application to pass attacker-controlled selectors, large documents or DOM structure, or text to these opt-in paths; default JustHTML(sanitize=True) does not expose selector injection, and the impact is limited to availability.