No, this is not a problem.
1. Brute-forcing would start with shorter passwords
Depending on implementation there can be padding, see the RFC. But even if there is no padding in protocol, you don't have to use it.
Suppose an attacker can send as many requests as technically possible, and the application can process them without any limits. We don't consider trivial cases when user account is blocked after several failed attempts and other measures that prevent brute-forcing.
Suppose passwords consist of 62 characters. How many attempts will the attacker need to test all possible password candidates?
- 10 characters: 10^62 candidates
- 11 characters: 11^62 candidates
- 12 characters: 12^62 candidates
To check all candidates of length 11 there are 62 times more attempts needed than for all candidates of length 10 (in the worst case). For the length 12 there are 3844 times more attempts needed than for the length 10. Etc.
Means, it makes sense for an attacker to test first shorter passwords, than longer ones, because for shorter passwords it takes essentially less resources than for the longer ones.
Thus, revealing password length does not give the attacker any essential advantage. The shorter the password the higher is the probability of successful brute-forcing.
2. Kerckhoffs' Principle
You should assume that the attacker knows everything including password length of particular user, and that only specific characters are not known. Thus, revealing password length will not give much advantage attacker.