Multiple security vulnerabilities were identified in the Tornado Python web framework prior to version 6.6.0. These include a denial-of-service condition caused by inefficient processing of HTTP/1.1 chunked transfer encoding, a CPU exhaustion issue due to obsolete HTTP header line folding, and an open redirect vulnerability in the RedirectHandler URL templates. These flaws allow unauthenticated remote attackers to stall the event loop, block other connections, or perform phishing attacks via crafted redirects. All issues are fixed in Tornado version 6.6.0.