CVE-2026-23842 ChatterBot has Denial of Service via Database Connection Pool Exhaustion
Attackers can cause persistent service unavailability in ChatterBot by exhausting the database connection pool through concurrent requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23842?
CVE-2026-23842 is a high-severity denial of service vulnerability in gunthercox ChatterBot, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.
Weakness: CWE-400
Which versions are affected by CVE-2026-23842?
3 open source packages ship an affected version, including chatterbot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chatterbot PyPI | All versions | 1.2.11 |
chatterbot PyPI | All versions | 1.2.11 |
chatterbot PyPI | All versions | 1.2.11 |
Products include Chatterbot Chatterbot.
How do I fix CVE-2026-23842?
Upgrade chatterbot to 1.2.11 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23842 being exploited?
There is no known exploitation of CVE-2026-23842 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-v4w8-49pv-mf72, PYSEC-2026-1244.