The general attack scenario:
In 2013 Django had a general vulnerability as an attacker could create extremely intense CPU calculations via very large passwords [see the security notice here]. I'm unsure if this is still possible when using PHP's password_verify() and other password-hashing methods without any further checks.
The PHP documentation says:
Using the PASSWORD_BCRYPT for the algo parameter, will result in the password parameter being truncated to a maximum length of 72 characters.
But, PHP's code MAYBE says something different:
The C code behind PHP 5.5.0's password_verify() function however does not limit the passed argument directly (maybe on a deeper level inside the bcrypt algorithm ?). Also, the PHP implementation does not limit the argument.
The question:
Is password_verify() (and other functions of the same function set) vulnerable against DoS via maxed out POST parameters ? Please also consider site-wide config situations of POST upload sizes much larger than 4MB.