When a client sends a request with a body, it usually states the size up front, for example Content-Length: 2048. The server then knows when the body ends, and can reject the request early if the number is larger than its limit, before reading the data.
The header has to agree with what is really sent. When two systems in a chain disagree about the length, or when both Content-Length and Transfer-Encoding are present, one may treat extra bytes as the start of the next request. That is the basis of HTTP request smuggling, and it is why modern proxies are strict about ambiguous messages.
A declared size is also only a claim. A server should enforce its limits while reading, not just trust the header, because a client can lie or can omit the header and use chunked encoding instead.
Reject requests with conflicting length information, keep servers and proxies updated, and enforce body limits on the actual bytes received.