Point 18.4 of the OWASP ASVS says
Verify that all input is limited to an appropriate size limit.
Currently i have an input limit of 50MB on all web services. (And it seems like this is the default in Microsoft Windows.) I imagine that such a high limit allows an easy denial-of-service attack, especially if multiple services can be attacked at the same time. Is this limit set too high? And how should one deal with services that require bigger requests?