There is a very informative discussion of this topic here.
As I understand it, Tomcat only enforces that limit if the content type is application/x-www-form-urlencoded
. For multiparts you'll have to read the stream yourself and enforce the limit yourself. A great tool for working with multipart data is Apache FileUpload.