[php-src] PR #23076: ext/standard: notice on long passwords in bcrypt
| From: | Sjord | Date: | Wed, 05 Aug 2026 19:06:50 +0000 |
| Subject: | [php-src] PR #23076: ext/standard: notice on long passwords in bcrypt | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37568@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23076
Author: Sjord
Bcrypt supports passwords up to 72 characters. The remainder is ignored.
Earlier proposed here:
- https://news-web.php.net/php.internals/75692
- https://wiki.php.net/rfc/password_hash_spec
Bcrypt truncation can result in serious security bugs:
- https://pentesterlab.com/blog/freshrss-bcrypt-truncation-auth-bypass
- https://www.invicti.com/blog/web-security/okta-vulnerability-bcrypt-auth