Vulnerabilities in pkg:pypi/chatterbot

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v4w8-49pv-mf72",
  "modified" : "2026-01-20T18:36:17Z",
  "published" : "2026-01-20T18:36:17Z",
  "aliases" : [ "CVE-2026-23842" ],
  "summary" : "ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion",
  "details" : "### Summary\nChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover.\n\n### Details\nChatterBot relies on SQLAlchemy for database access and uses a connection pool with default limits. The get_response() method does not enforce concurrency limits, rate limiting, or explicit session lifecycle controls.\n\nWhen multiple threads concurrently invoke get_response(), database connections are rapidly consumed and not released in a timely manner. This leads to exhaustion of the SQLAlchemy QueuePool, causing subsequent requests to block and eventually fail with a TimeoutError.\n\nThis issue can be triggered without authentication in deployments where ChatterBot is exposed as a chatbot service, making it exploitable by remote attackers to cause denial of service.\n\nPoC Video: \nhttps://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f\n\n### PoC\n1. Install ChatterBot version 1.2.10.\n2. Use the default database configuration (SQLite / SQLAlchemy).\n3. Run the following Python script to invoke concurrent requests:\n\nfrom chatterbot import ChatBot\nimport threading\n\nbot = ChatBot(\"dos-test\")\n\ndef attack():\n    bot.get_response(\"hello\")\n\nthreads = []\nfor _ in range(30):\n    t = threading.Thread(target=attack)\n    t.start()\n    threads.append(t)\n\nfor t in threads:\n    t.join()\n\n4. Observe that the application becomes unresponsive and raises SQLAlchemy TimeoutError exceptions indicating exhaustion of the connection pool.\n\n### Impact\nThis vulnerability allows an attacker to trigger a denial-of-service condition by exhausting the database connection pool. Once triggered, the chatbot becomes unresponsive to legitimate users and requires a manual restart to restore functionality.\n\nAll deployments of ChatterBot version 1.2.10 or earlier that allow concurrent access to the get_response() method are impacted.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "chatterbot"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.2.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.2.10"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23842"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gunthercox/ChatterBot/pull/2432"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gunthercox/ChatterBot"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-20T18:36:17Z",
    "nvd_published_at" : "2026-01-19T19:16:04Z"
  }
}