Description
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gunthercox | ChatterBot | < 1.2.11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
AdityaBhatt3010/CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10 ★ 2 · Mar 1, 2026
CVE-2026-23842 — High severity Denial-of-Service vulnerability caused by SQLAlchemy connection pool exhaustion in concurrent get_response() calls in ChatterBot ≤ 1.2.10.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | chatterbot | < 1.2.11 | 1.2.11 | GHSA-v4w8-49pv-mf72 |
References
- https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72
- https://github.com/gunthercox/ChatterBot/pull/2432
- https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf
- https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11
- https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f