diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html
index c2eb48137a..2be63eb866 100644
--- a/phpBB/docs/CHANGELOG.html
+++ b/phpBB/docs/CHANGELOG.html
@@ -211,6 +211,7 @@
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11368">PHPBB3-11368</a>] - Latest pm reports row count</li>
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11583">PHPBB3-11583</a>] - InnoDB supports FULLTEXT index since MySQL 5.6.4.</li>
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11740">PHPBB3-11740</a>] - Update link in FAQ to Ideas Centre</li>
+<li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11873">PHPBB3-11873</a>] - Prevent expensive hash computation in phpbb_check_hash() by rejecting very long passwords</li>
 </ul>
 <h4>Sub-task</h4>
 <ul>
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index b3e50847fd..869396f6b7 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -442,6 +442,13 @@ function phpbb_hash($password)
 */
 function phpbb_check_hash($password, $hash)
 {
+	if (strlen($password) > 4096)
+	{
+		// If the password is too huge, we will simply reject it
+		// and not let the server try to hash it.
+		return false;
+	}
+
 	$itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 	if (strlen($hash) == 34)
 	{
diff --git a/tests/security/hash_test.php b/tests/security/hash_test.php
index 0c2580c19b..e226365ef3 100644
--- a/tests/security/hash_test.php
+++ b/tests/security/hash_test.php
@@ -17,5 +17,13 @@ class phpbb_security_hash_test extends phpbb_test_case
 		$this->assertTrue(phpbb_check_hash('test', '$P$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
 		$this->assertFalse(phpbb_check_hash('foo', '$H$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
 	}
+
+	public function test_check_hash_with_large_input()
+	{
+		// 16 MB password, should be rejected quite fast
+		$start_time = time();
+		$this->assertFalse(phpbb_check_hash(str_repeat('a', 1024 * 1024 * 16), '$H$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
+		$this->assertLessThanOrEqual(5, time() - $start_time);
+	}
 }