Headers are the lines such as Host, User-Agent and Cookie that accompany every request. A normal browser sends perhaps a dozen to twenty. An attacker can send hundreds, each needing to be read, stored and checked.
Servers protect themselves with limits. Apache has LimitRequestFields, which defaults to 100, and LimitRequestFieldSize for the length of each line. Nginx sets buffer sizes for the request line and headers, and answers with a 4xx error if they are exceeded. Proxies and load balancers apply their own caps.
An unusually large header count can be part of a denial of service attempt, an attempt to confuse a parser, or a way to push a harmful value past the amount a security filter inspects. Different components may count and truncate headers differently, which is why mismatched limits are a risk.
Keep the limits reasonable, make sure the proxy and the origin agree, and watch for requests that hit them, since they are often probes.