Tornado versions prior to 6.4.2 contain a denial-of-service vulnerability due to an inefficient HTTP cookie parsing algorithm. The parsing algorithm can exhibit quadratic time complexity when processing specially crafted cookie headers, causing excessive CPU usage. This occurs in the event loop thread, potentially blocking other requests and degrading service availability. A fix is available in Tornado version 6.4.2.