A multipart body can contain a large number of parts. A normal form has a handful, but a request built by hand can have thousands, each with its own boundary and headers. The server must parse and keep track of every one.

An unusually high part count can be used to waste memory or CPU, to push a payload beyond the point where a WAF stops inspecting, or to trigger bugs in a parser that does not expect so many. Some software has a setting for the maximum number of parts or files it will accept per request, and some does not, so the limit has to be added at another layer.

A limit like this is cheap to apply and rarely affects real users, because ordinary forms are small. Pick a number comfortably above the largest legitimate form on your site.

If a vendor advises capping parts, fields or file counts as a mitigation, treat it as a stop-gap and apply the actual patch as well.