With Transfer-Encoding: chunked, the sender transmits the body as a series of chunks, each prefixed by its own length, and ends with a zero-length chunk. This is useful when the sender does not know the final size, such as when data is generated on the fly, so no Content-Length header is needed.

For a defender, that makes size checks harder. A server cannot reject a request by looking at a header, because there is none. It has to count bytes as they arrive and stop when a limit is passed. Some filters and WAFs handle chunked bodies less thoroughly than ordinary ones, and attackers have used chunked encoding to split a payload into pieces that are not reassembled before inspection.

Chunked encoding is legitimate and is common in HTTP/1.1. Do not block it entirely, but make sure the limits still apply, and check how your proxy and WAF treat it.

If a vendor lists a mitigation that blocks or limits chunked requests to a certain path, note that it addresses one technique and is not a replacement for the patch.