HTML 4
From an HTML 4 perspective, attributes are an SGML construct. Their limits are defined in the SGML Declaration of HTML 4:
QUANTITY SGMLREF
ATTCNT 60 -- increased --
ATTSPLEN 65536 -- These are the largest values --
LITLEN 65536 -- permitted in the declaration --
NAMELEN 65536 -- Avoid fixed limits in actual --
PILEN 65536 -- implementations of HTML UA's --
TAGLVL 100
TAGLEN 65536
GRPGTCNT 150
GRPCNT 64
The value in question here is "ATTSPLEN" which would be the limit on an element's attribute specification list (which should be the total size of all attributes for that element). The note above mentions that fixed limits should be avoided, however, so it's likely that there is no real limit other than available memory in most implementations.
HTML 5
HTML 5 seems to be different, as the spec says, "This version of HTML thus returns to a non-SGML basis."
Later on, when describing how to parse HTML 5, the following passage appears (emphasis added):
The algorithm described below places
no limit on the depth of the DOM tree
generated, or on the length of tag
names, attribute names, attribute
values, text nodes, etc. While
implementors are encouraged to avoid
arbitrary limits, it is recognized
that practical concerns will likely
force user agents to impose nesting
depth constraints.
So I suppose that is your answer.