In tornado < 6.5.8, application/x-www-form-urlencoded bodies are parsed via urllib.parse.parse_qs in tornado/escape.py without max_num_fields. An unauthenticated request with millions of &-delimited fields is parsed synchronously in RequestHandler._execute (HTTPServerRequest._parse_body/parse_body_arguments), stalling the single-threaded event loop and delaying all connections. Upgrade to tornado 6.5.8 to mitigate.