Is there any security risk with raising client_max_body_size nginx?

Setting client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files. client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge that you put your server in the same scenario as by 2013 when Django allowed users to use a very long password forcing Django (rather the server where it is hosted) to perform very expensive hash calculations leading, as you may guess, to a denial-of-service attack against the whole Django's authentication framework.

This being said, there are other things you need to think about if you increase the size of client_max_body_size too much. For instance, how will you set keepalive_timeout parameter ? How could you calculate it based on the fact that client_max_body_size is set to 20 GB ? Maybe 20 seconds ? 20 minutes ? Two hours ? Same question concerns client_header_timeout and client_body_timeout that set, respectively, set the maximum amount of time Nginx will wait around on the client to specify a request header or ask for an object to be served.