Without validating this info, but I think the limit for HTTP header length is set to 8K. Thus, if you filter for icao24 addresses in the /states/all request, the limit should be somewhere around
(8192 - len("GET /api/states/all"))/len("&icao24=xxxxxx") = 583