Tornado below 6.6.0 vulnerable to event loop blocking via chunked requests

CVE-2026-115927 (CVSS 5.3) in Tornado before 6.6.0 lets an unauthenticated attacker send millions of 1-byte chunks, starving the asyncio event loop and causing ~20x memory amplification. The flaw is fixed in Tornado 6.6.0.

• CVSS 5.3, CWE-400: unauthenticated DoS via HTTP/1.1 chunked encoding
• 1-byte chunks cause roughly 20x memory amplification
• Fixed in Tornado 6.6.0 with bytearray and periodic yielding
• POC published; EPSS score 0.384%