[GHSA] GHSA-8423-8fgw-73vq (medium) — tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

GHSA-8423-8fgw-73vq Severity: medium CVE: None

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

## Description

### Summary

`parse_multipart_form_data` (httputil.py:34) calls `data.split(b"--"+boundary+b"\r\n")` **before** the `max_parts` check (:35). A 600KB body with 100k parts creates a 100k-element transient list first, th