Vulnerability-Lookup

CVE-2026-23842 (GCVE-0-2026-23842)

Vulnerability from cvelistv5 – Published: 2026-01-19 18:39 – Updated: 2026-01-20 20:05

Title

ChatterBot has Denial of Service via Database Connection Pool Exhaustion

Summary

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-20 20:04 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/gunthercox/ChatterBot/security…	x_refsource_CONFIRM
https://github.com/gunthercox/ChatterBot/pull/2432	x_refsource_MISC
https://github.com/gunthercox/ChatterBot/commit/d…	x_refsource_MISC
https://github.com/gunthercox/ChatterBot/releases…	x_refsource_MISC
https://github.com/user-attachments/assets/4ee845…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
gunthercox	ChatterBot	Affected: < 1.2.11	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T20:04:06.342314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-20T20:05:48.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ChatterBot",
          "vendor": "gunthercox",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-19T18:39:37.059Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
        },
        {
          "name": "https://github.com/gunthercox/ChatterBot/pull/2432",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
        },
        {
          "name": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
        },
        {
          "name": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
        },
        {
          "name": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
        }
      ],
      "source": {
        "advisory": "GHSA-v4w8-49pv-mf72",
        "discovery": "UNKNOWN"
      },
      "title": "ChatterBot has Denial of Service via Database Connection Pool Exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23842",
    "datePublished": "2026-01-19T18:39:37.059Z",
    "dateReserved": "2026-01-16T15:46:40.842Z",
    "dateUpdated": "2026-01-20T20:05:48.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23842",
      "date": "2026-09-20",
      "epss": "0.00549",
      "percentile": "0.44816"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "ChatterBot",
                "vendor": "gunthercox",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.2.11"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:chatterbot:chatterbot:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D8B9379-D459-4198-B388-2BCC2378AB98",
                    "versionEndExcluding": "1.2.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue."
          },
          {
            "lang": "es",
            "value": "ChatterBot es un motor de di\u00e1logo conversacional de aprendizaje autom\u00e1tico para crear chatbots. Las versiones de ChatterBot hasta la 1.2.10 son vulnerables a una condici\u00f3n de denegaci\u00f3n de servicio causada por una gesti\u00f3n inadecuada de la sesi\u00f3n de base de datos y del pool de conexiones. Las invocaciones concurrentes del m\u00e9todo get_response() pueden agotar el pool de conexiones subyacente de SQLAlchemy, lo que resulta en una indisponibilidad persistente del servicio y requiere un reinicio manual para recuperarse. La versi\u00f3n 1.2.11 soluciona el problema."
          }
        ],
        "id": "CVE-2026-23842",
        "lastModified": "2026-06-17T10:22:11.350",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-23842",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T20:04:06.342314Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-19T19:16:04.510",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product",
              "Release Notes"
            ],
            "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit"
            ],
            "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-20T19:20:49+00:00",
      "cve": "CVE-2026-23842",
      "id": "CVE-2026-23842",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ChatterBot has Denial of Service via Database Connection Pool Exhaustion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23842.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-23842",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-20T20:04:06.342314Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-20T20:04:07.426Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "ChatterBot",
              "vendor": "gunthercox",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.2.11"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-19T18:39:37.059Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
            },
            {
              "name": "https://github.com/gunthercox/ChatterBot/pull/2432",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
            },
            {
              "name": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
            },
            {
              "name": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
            },
            {
              "name": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
            }
          ],
          "source": {
            "advisory": "GHSA-v4w8-49pv-mf72",
            "discovery": "UNKNOWN"
          },
          "title": "ChatterBot has Denial of Service via Database Connection Pool Exhaustion"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-23842",
        "datePublished": "2026-01-19T18:39:37.059Z",
        "dateReserved": "2026-01-16T15:46:40.842Z",
        "dateUpdated": "2026-01-19T18:39:37.059Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-23842

Vulnerability from fkie_nvd - Published: 2026-01-19 19:16 - Updated: 2026-06-17 10:22

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf	Patch
security-advisories@github.com	https://github.com/gunthercox/ChatterBot/pull/2432	Issue Tracking
security-advisories@github.com	https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11	Product, Release Notes
security-advisories@github.com	https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72	Exploit, Vendor Advisory
security-advisories@github.com	https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f	Exploit

Impacted products

	Vendor	Product	Version
	chatterbot	chatterbot	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ChatterBot",
          "vendor": "gunthercox",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.11"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chatterbot:chatterbot:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D8B9379-D459-4198-B388-2BCC2378AB98",
              "versionEndExcluding": "1.2.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue."
    },
    {
      "lang": "es",
      "value": "ChatterBot es un motor de di\u00e1logo conversacional de aprendizaje autom\u00e1tico para crear chatbots. Las versiones de ChatterBot hasta la 1.2.10 son vulnerables a una condici\u00f3n de denegaci\u00f3n de servicio causada por una gesti\u00f3n inadecuada de la sesi\u00f3n de base de datos y del pool de conexiones. Las invocaciones concurrentes del m\u00e9todo get_response() pueden agotar el pool de conexiones subyacente de SQLAlchemy, lo que resulta en una indisponibilidad persistente del servicio y requiere un reinicio manual para recuperarse. La versi\u00f3n 1.2.11 soluciona el problema."
    }
  ],
  "id": "CVE-2026-23842",
  "lastModified": "2026-06-17T10:22:11.350",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23842",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-20T20:04:06.342314Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-19T19:16:04.510",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V4W8-49PV-MF72

Vulnerability from github – Published: 2026-01-20 18:36 – Updated: 2026-01-20 18:36

Summary

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

Details

Summary

ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover.

Details

ChatterBot relies on SQLAlchemy for database access and uses a connection pool with default limits. The get_response() method does not enforce concurrency limits, rate limiting, or explicit session lifecycle controls.

When multiple threads concurrently invoke get_response(), database connections are rapidly consumed and not released in a timely manner. This leads to exhaustion of the SQLAlchemy QueuePool, causing subsequent requests to block and eventually fail with a TimeoutError.

This issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.

PoC Video: https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f

PoC

Install ChatterBot version 1.2.10.
Use the default database configuration (SQLite / SQLAlchemy).
Run the following Python script to invoke concurrent requests:

from chatterbot import ChatBot import threading

bot = ChatBot("dos-test")

def attack(): bot.get_response("hello")

threads = [] for _ in range(30): t = threading.Thread(target=attack) t.start() threads.append(t)

for t in threads: t.join()

Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.

Impact

This vulnerability allows an attacker to trigger a denial-of-service condition by exhausting the database connection pool. Once triggered, the chatbot becomes unresponsive to legitimate users and requires a manual restart to restore functionality.

All deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.10"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "chatterbot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-20T18:36:17Z",
    "nvd_published_at": "2026-01-19T19:16:04Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover.\n\n### Details\nChatterBot relies on SQLAlchemy for database access and uses a connection pool with default limits. The get_response() method does not enforce concurrency limits, rate limiting, or explicit session lifecycle controls.\n\nWhen multiple threads concurrently invoke get_response(), database connections are rapidly consumed and not released in a timely manner. This leads to exhaustion of the SQLAlchemy QueuePool, causing subsequent requests to block and eventually fail with a TimeoutError.\n\nThis issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.\n\nPoC Video: \nhttps://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f\n\n### PoC\n1. Install ChatterBot version 1.2.10.\n2. Use the default database configuration (SQLite / SQLAlchemy).\n3. Run the following Python script to invoke concurrent requests:\n\nfrom chatterbot import ChatBot\nimport threading\n\nbot = ChatBot(\"dos-test\")\n\ndef attack():\n    bot.get_response(\"hello\")\n\nthreads = []\nfor _ in range(30):\n    t = threading.Thread(target=attack)\n    t.start()\n    threads.append(t)\n\nfor t in threads:\n    t.join()\n\n4. Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.\n\n### Impact\nThis vulnerability allows an attacker to trigger a denial-of-service condition by exhausting the database connection pool. Once triggered, the chatbot becomes unresponsive to legitimate users and requires a manual restart to restore functionality.\n\nAll deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.",
  "id": "GHSA-v4w8-49pv-mf72",
  "modified": "2026-01-20T18:36:17Z",
  "published": "2026-01-20T18:36:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23842"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gunthercox/ChatterBot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion"
}

PYSEC-2026-1244

Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:23

Details

Summary

Details

This issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.

PoC Video: https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f

PoC

Install ChatterBot version 1.2.10.
Use the default database configuration (SQLite / SQLAlchemy).
Run the following Python script to invoke concurrent requests:

from chatterbot import ChatBot import threading

bot = ChatBot("dos-test")

def attack(): bot.get_response("hello")

threads = [] for _ in range(30): t = threading.Thread(target=attack) t.start() threads.append(t)

for t in threads: t.join()

Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.

Impact

All deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impacted products

Name	purl
chatterbot	pkg:pypi/chatterbot

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "chatterbot",
        "purl": "pkg:pypi/chatterbot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.0",
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.3.4",
        "0.3.5",
        "0.3.6",
        "0.3.7",
        "0.4.0",
        "0.4.1",
        "0.4.10",
        "0.4.11",
        "0.4.12",
        "0.4.13",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.4.5",
        "0.4.6",
        "0.4.7",
        "0.4.8",
        "0.4.9",
        "0.5.0",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.7.4",
        "0.7.5",
        "0.7.6",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "1.0.0",
        "1.0.0a1",
        "1.0.0a2",
        "1.0.0a3",
        "1.0.0a4",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.7",
        "1.0.8",
        "1.1.0",
        "1.1.0a7",
        "1.2.0",
        "1.2.1",
        "1.2.10",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23842",
    "GHSA-v4w8-49pv-mf72"
  ],
  "details": "### Summary\nChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover.\n\n### Details\nChatterBot relies on SQLAlchemy for database access and uses a connection pool with default limits. The get_response() method does not enforce concurrency limits, rate limiting, or explicit session lifecycle controls.\n\nWhen multiple threads concurrently invoke get_response(), database connections are rapidly consumed and not released in a timely manner. This leads to exhaustion of the SQLAlchemy QueuePool, causing subsequent requests to block and eventually fail with a TimeoutError.\n\nThis issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.\n\nPoC Video: \nhttps://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f\n\n### PoC\n1. Install ChatterBot version 1.2.10.\n2. Use the default database configuration (SQLite / SQLAlchemy).\n3. Run the following Python script to invoke concurrent requests:\n\nfrom chatterbot import ChatBot\nimport threading\n\nbot = ChatBot(\"dos-test\")\n\ndef attack():\n    bot.get_response(\"hello\")\n\nthreads = []\nfor _ in range(30):\n    t = threading.Thread(target=attack)\n    t.start()\n    threads.append(t)\n\nfor t in threads:\n    t.join()\n\n4. Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.\n\n### Impact\nThis vulnerability allows an attacker to trigger a denial-of-service condition by exhausting the database connection pool. Once triggered, the chatbot becomes unresponsive to legitimate users and requires a manual restart to restore functionality.\n\nAll deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.",
  "id": "PYSEC-2026-1244",
  "modified": "2026-07-07T17:23:54.115855Z",
  "published": "2026-07-07T16:03:19.183779Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23842"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/pull/2432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gunthercox/ChatterBot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/chatterbot"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v4w8-49pv-mf72"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-23842 (GCVE-0-2026-23842)

FKIE_CVE-2026-23842

GHSA-V4W8-49PV-MF72

Summary

Details

PoC

Impact

PYSEC-2026-1244

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour