HTML 4
From an HTML 4 perspective, attributes are an SGML construct. Their limits are defined in the SGML Declaration of HTML 4:
QUANTITY SGMLREF ATTCNT 60 -- increased -- ATTSPLEN 65536 -- These are the largest values -- LITLEN 65536 -- permitted in the declaration -- NAMELEN 65536 -- Avoid fixed limits in actual -- PILEN 65536 -- implementations of HTML UA's -- TAGLVL 100 TAGLEN 65536 GRPGTCNT 150 GRPCNT 64
The value in question here is “ATTSPLEN” which would be the limit on an element’s attribute specification list (which should be the total size of all attributes for that element). The note above mentions that fixed limits should be avoided, however, so it’s likely that there is no real limit other than available memory in most implementations.
HTML 5
It would seem that HTML 5 has no limits on the length of attribute values.
As the spec says, “This version of HTML thus returns to a non-SGML basis.”
Later on, when describing how to parse HTML 5, the following passage appears (emphasis added):
The algorithm described below places
no limit on the depth of the DOM tree
generated, or on the length of tag
names, attribute names, attribute
values, text nodes, etc. While
implementors are encouraged to avoid
arbitrary limits, it is recognized
that practical concerns will likely
force user agents to impose nesting
depth constraints.
Therefore, (theoretically) there is no limit to the length/size of HTML 5 attributes.