---
id: CVE-2026-23842
aliases:
  - GHSA-v4w8-49pv-mf72
  - PYSEC-2026-1244
title: >-
  ChatterBot Vulnerable to Denial of Service via Database Connection Pool
  Exhaustion
summary: >-
  ChatterBot Vulnerable to Denial of Service via Database Connection Pool
  Exhaustion
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: chatterbot
product: chatterbot
ecosystem: pip
affected:
  - chatterbot < 1.2.11
patched:
  - chatterbot 1.2.11
published: '2026-01-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v4w8-49pv-mf72'
references:
  - url: >-
      https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23842'
  - url: 'https://github.com/gunthercox/ChatterBot/pull/2432'
  - url: >-
      https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf
  - url: 'https://github.com/gunthercox/ChatterBot'
  - url: 'https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11'
  - url: >-
      https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00549
epssPercentile: 0.43596
ingestedAt: '2026-07-08T18:25:53.073Z'
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/AdityaBhatt3010/CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10
  checkedAt: '2026-09-26T09:05:40.410Z'
exploitAvailable: true
---

## Overview

### Summary
ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover.

### Details
ChatterBot relies on SQLAlchemy for database access and uses a connection pool with default limits. The get_response() method does not enforce concurrency limits, rate limiting, or explicit session lifecycle controls.

When multiple threads concurrently invoke get_response(), database connections are rapidly consumed and not released in a timely manner. This leads to exhaustion of the SQLAlchemy QueuePool, causing subsequent requests to block and eventually fail with a TimeoutError.

This issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.

PoC Video: 
https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f

### PoC
1. Install ChatterBot version 1.2.10.
2. Use the default database configuration (SQLite / SQLAlchemy).
3. Run the following Python script to invoke concurrent requests:

from chatterbot import ChatBot
import threading

bot = ChatBot("dos-test")

def attack():
    bot.get_response("hello")

threads = []
for _ in range(30):
    t = threading.Thread(target=attack)
    t.start()
    threads.append(t)

for t in threads:
    t.join()

4. Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.

### Impact
This vulnerability allows an attacker to trigger a denial-of-service condition by exhausting the database connection pool. Once triggered, the chatbot becomes unresponsive to legitimate users and requires a manual restart to restore functionality.

All deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.

## Affected packages

- `chatterbot < 1.2.11`

## Remediation

Upgrade to a patched release:

- `chatterbot 1.2.11`