tornado/httpserver.py, line 283
The call to HTTPHeaders.parse() is not in a try block, so if there's a malformed header, the exception isn't caught. It would be better to do this:
headers = httputil.HTTPHeaders.parse(data[eol:])
raise _BadRequestException("Malformed header")
which is consistent with how other problems in the headers are handled. ValueError is the most likely, because that's what you get if a header line contains no colon; the tuple unpack inside parse_line() fails.
Handle malformed headers more gracefully.