PT-2026-3483 · Unknown · Chatterbot

Adityabhatt3010 · Published 2026-01-19 · Updated 2026-02-05 · CVE-2026-23842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ChatterBot versions up to 1.2.10 ChatterBot version 1.2.11

Description ChatterBot, a machine learning conversational dialog engine, is susceptible to a denial-of-service condition. This occurs due to improper management of database sessions and connection pools. Concurrent calls to the get response() method can deplete the SQLAlchemy connection pool, leading to service unavailability and requiring a manual restart for recovery. The issue stems from the get response() method lacking concurrency limits, rate limiting, or explicit session lifecycle controls. Rapid consumption of database connections without timely release exhausts the SQLAlchemy QueuePool, causing requests to block and ultimately fail with a TimeoutError. This can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service.

Recommendations ChatterBot versions up to 1.2.10 should be updated to version 1.2.11.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-23842

GHSA-V4W8-49PV-MF72

Affected Products

Chatterbot

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23842.json · Exploit
• 🔥❌ https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f · Exploit, Deleted
• https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72 · Vendor Advisory
• https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf · Patch
• https://osv.dev/vulnerability/GHSA-v4w8-49pv-mf72 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23842 · Security Note
• https://github.com/gunthercox/ChatterBot · Note
• https://github.com/gunthercox/ChatterBot/pull/2432 · Note
• https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11 · Note
• https://twitter.com/CVEnew/status/2013324704879137179 · Twitter Post
• https://t.me/cveNotify/151032 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2013447179684216846 · Twitter Post