The default is 8M. If a request body is larger than the limit, PHP discards it, and $_POST and $_FILES arrive empty. It must be at least as large as upload_max_filesize, since uploaded files are part of the same body, and large uploads also need web server limits such as NGINX's client_max_body_size to be high enough.
Setting it too high invites abuse. Every request that PHP is willing to read uses memory and time, so a generous limit can help an attacker exhaust resources. It can only be set in the main configuration or per directory, not from a script.
PHP's advisory suggests it as a partial mitigation for CVE-2026-109618: use 8M if your site does not accept uploads and 32M if it does, and keep upload_max_filesize below it. A low limit makes it harder to send the large requests that the out-of-memory path needs, but it does not remove the flaw.
Also enforce limits at the web server or proxy, including for requests without a Content-Length header, and then update PHP.