PT-2026-28775

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML. init always reaches TreeBuilder.finish, which unconditionally calls populate selectedcontent. That function recursively traverses the DOM via find elements / find element without a depth boun...