CVE-2026-23842: ChatterBot Denial of Service via Database Connection Pool Exhaustion
Summary
CVE-2026-23842: ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion. Affects chatterbot versions < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ChatterBot is an open-source Python library designed for creating conversational agents or chatbots. It utilizes machine learning algorithms to generate responses based on user input. The library is built on SQLAlchemy for database interactions, which allows it to support various database backends. However, certain versions of ChatterBot are vulnerable to a denial-of-service (DoS) condition due to improper management of database connections, particularly when handling concurrent requests.
Vulnerability Detail
The vulnerability arises from ChatterBot versions up to 1.2.10, where the get_response() method does not impose limits on concurrent access. This oversight leads to rapid consumption of database connections, which are not released promptly, resulting in exhaustion of the SQLAlchemy connection pool. When this occurs, legitimate requests are blocked and ultimately fail with a TimeoutError. This vulnerability can be exploited remotely, allowing attackers to trigger a denial-of-service condition without authentication, making the chatbot unresponsive to users.
How To Fix
Latest published version: 1.2.15 as of 22 Oct 2026
pip install --upgrade "chatterbot==1.2.15"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.11
This is the first release that contains the fix.
pip install --upgrade "chatterbot==1.2.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent threads accessing the get_response() method. Here is an example of how to implement a simple rate limit using a semaphore in Python:
from chatterbot import ChatBot import threading import time
bot = ChatBot("dos-test") semaphore = threading.Semaphore(5) # Limit to 5 concurrent requests
def attack():
with semaphore:
bot.get_response("hello")
time.sleep(1) # Simulate processing time
threads = [] for _ in range(30): t = threading.Thread(target=attack) t.start() threads.append(t)
for t in threads: t.join()
Conclusion
The ChatterBot library is vulnerable to a denial-of-service condition due to improper database connection management in versions up to 1.2.10. Users are advised to update to version 1.2.11 or later to mitigate this risk. Additionally, implementing a temporary workaround can help manage concurrent requests until the update is applied.
See every vulnerability recorded for chatterbot →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
ChatterBot versions up to 1.2.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, the vulnerability can lead to a denial-of-service condition, making the chatbot unresponsive and requiring a manual restart to restore functionality.
Yes, a patch is available in ChatterBot version 1.2.11 and later. It is recommended to update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for chatterbot.
