Tornado HTTP servers have a vulnerability in their HTTP header parser that causes quadratic CPU usage when parsing headers with obsolete line folding (line continuation with leading whitespace). This can be exploited by unauthenticated attackers sending specially crafted requests with many short continuation lines, leading to significant CPU consumption and blocking the event loop. The issue affects all Tornado versions prior to 6.6. The vulnerability impacts availability only and has been fixed in Tornado 6.6 by rejecting headers with leading whitespace. Mitigations include keeping the max_header_size at default or lower and using a reverse proxy to normalize or reject such headers.