PT-2026-3483 · Unknown · Chatterbot
Adityabhatt3010
·
Publicado
2026-01-19
·
Atualizado
2026-02-05
·
CVE-2026-23842
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
ChatterBot versions up to 1.2.10
ChatterBot version 1.2.11
Description
ChatterBot, a machine learning conversational dialog engine, is susceptible to a denial-of-service condition. This occurs due to improper management of database sessions and connection pools. Concurrent calls to the
get response() method can deplete the SQLAlchemy connection pool, leading to service unavailability and requiring a manual restart for recovery. The issue stems from the get response() method lacking concurrency limits, rate limiting, or explicit session lifecycle controls. Rapid consumption of database connections without timely release exhausts the SQLAlchemy QueuePool, causing requests to block and ultimately fail with a TimeoutError. This can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service.Recommendations
ChatterBot versions up to 1.2.10 should be updated to version 1.2.11.
Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Chatterbot