{"record":{"id":"e9a5373828e73a7d","repo":"ory/kratos","slug":"bcrypt-cost-d-exceeds-max-d","errorCode":null,"errorMessage":"bcrypt cost=%d exceeds max %d","messagePattern":"bcrypt cost=(.+?) exceeds max (.+?)","errorType":"validation","errorClass":"ErrHashParametersOutOfBounds","httpStatus":null,"severity":"error","filePath":"hash/hash_limits.go","lineNumber":131,"sourceCode":"\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 p=%d not in [1, %d]\", parallelism, maxArgon2Parallelism)\n\t}\n\treturn nil\n}\n\nfunc validatePbkdf2Params(iterations uint32) error {\n\tif iterations == 0 || iterations > maxPbkdf2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"pbkdf2 i=%d not in [1, %d]\", iterations, maxPbkdf2Iterations)\n\t}\n\treturn nil\n}\n\nfunc validateBcryptHashCost(hashed []byte) error {\n\tcost, err := bcrypt.Cost(hashed)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif cost > maxBcryptCost {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"bcrypt cost=%d exceeds max %d\", cost, maxBcryptCost)\n\t}\n\treturn nil\n}\n\n// ValidateImportedHash performs cost-parameter bounds checking on a hash\n// before it is persisted via the admin identity import API. It is the\n// import-time counterpart to the bounds checks in the compare* paths and\n// exists so we fail fast on malicious imports rather than persisting a hash\n// that would crash the process at every login attempt.\n//\n// Hashers without attacker-controlled cost parameters (md5-crypt, sha-crypt,\n// the static SHA/MD5/HMAC families, SSHA) pass through unchanged.\nfunc ValidateImportedHash(hashed []byte) error {\n\tswitch {\n\tcase IsBcryptHash(hashed):\n\t\treturn validateBcryptHashCost(hashed)\n\tcase IsArgon2idHash(hashed), IsArgon2iHash(hashed):\n\t\t_, _, _, err := decodeArgon2idHash(string(hashed))","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/hash/hash_limits.go#L113-L149","documentation":"validateBcryptHashCost parsed the cost parameter embedded in an existing bcrypt hash (during comparison or import validation) and found it above the compiled-in maxBcryptCost limit. The wrapped sentinel ErrHashParametersOutOfBounds marks this as an out-of-bounds hashing parameter; the fault is in the stored/imported hash, not in user input.","triggerScenarios":"Thrown at hash/hash_limits.go:131 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the offending hash with a cost within the allowed maximum","If the high cost is intentional and policy allows, raise maxBcryptCost and rebuild","Reject or skip the imported credential hash that carries the excessive cost"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}