Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-23842ChatterBot has Denial of Service via Database Connection Pool Exhaustion

High 7.5

In plain English

A high-severity uncontrolled resource consumption in ChatterBot from gunthercox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	chatterbot	1.2.11	GHSA-v4w8-49pv-mf72
PyPI	chatterbot	1.2.11	PYSEC-2026-1244

Affected products (as reported)

Vendor	Product	Versions
gunthercox	ChatterBot	< 1.2.11

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72 x_refsource_CONFIRM
https://github.com/gunthercox/ChatterBot/pull/2432 x_refsource_MISC
https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf x_refsource_MISC
https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11 x_refsource_MISC
https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f x_refsource_MISC