TI-2026-19205 Aliases CVE-2026-23842 GHSA-v4w8-49pv-mf72

ChatterBot has Denial of Service via Database Connection Pool Exhaustion

MEDIUM 40CWE-400Published 2026-01-19 · Updated 2026-01-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00541 45th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed ChatterBot (gunthercox): 1.2.11chatterbot (PyPI): 1.2.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gunthercox	ChatterBot	before 1.2.11	1.2.11	Patch available	CNA
—	chatterbot (PyPI)	before 1.2.11	1.2.11	Patch available	GHSA-v4w8-49pv-mf72

ChatterBot Vendorgunthercox Affected before 1.2.11 Fixed in 1.2.11 Patch available CNA
chatterbot (PyPI) Vendor— Affected before 1.2.11 Fixed in 1.2.11 Patch available GHSA-v4w8-49pv-mf72

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:chatterbot:chatterbot::::::::	before 1.2.11	Vulnerable	Chatterbot

cpe:2.3:a:chatterbot:chatterbot:*:*:*:*:*:*:*:* Versions before 1.2.11 Vulnerable ·Chatterbot

Remediation

Fix · CNA ChatterBot (gunthercox) Fixed in 1.2.11
Fix · GHSA-v4w8-49pv-mf72 chatterbot (PyPI) Fixed in 1.2.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-23842
2026-10-03 Alias added: GHSA-v4w8-49pv-mf72

References

Exploit 2

Patch 1

https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-23842

Other 3

TI-2026-41913 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences