A web server has a configuration file with 'LimitRequestBody 0' in Apache. What security risk does setting this to 0 create?

• A.LimitRequestBody 0 in Apache means no limit on request body size. An attacker can send arbitrarily large request bodies to exhaust server memory, disk space (if bodies are written to temp files), or cause timeout conditions - effectively a denial-of-service attack. A reasonable limit (e.g., 10MB for a general API, 100MB for file upload endpoints) should be configured
• B.LimitRequestBody 0 in Apache turns off request body inspection by mod_security (a module setting), the module then skips POST payloads in the rule engine, a gap that lets SQL injection strings through unchecked on form submissions of the site
• C.LimitRequestBody 0 sets the body timeout to zero seconds (the default is 60), a worker then waits for each client to finish the upload with no deadline, a slowloris style attack that holds the connection pool at its maximum until the MaxRequestWorkers limit is reached