CVE-2026-23842
HIGHChatterBot < 1.2.11 - Denial of Service via SQLAlchemy Connection Pool Exhaustion
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-23842. PoCs published by XiaomingX, AdityaBhatt3010.
AI-analyzed exploit summary The repository contains a functional PoC demonstrating a DoS vulnerability in ChatterBot ≤ 1.2.10 via database connection pool exhaustion. The PoC uses concurrent threads to trigger SQLAlchemy QueuePool depletion, leading to service unavailability.
Description
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.
Exploits (2)
The repository contains a functional PoC demonstrating a DoS vulnerability in ChatterBot ≤ 1.2.10 via database connection pool exhaustion. The PoC uses concurrent threads to trigger SQLAlchemy QueuePool depletion, leading to service unavailability.
The repository contains a functional PoC for CVE-2026-23842, demonstrating a DoS vulnerability in ChatterBot ≤ 1.2.10 via database connection pool exhaustion. The PoC uses concurrent threads to trigger SQLAlchemy QueuePool exhaustion, leading to service unavailability.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H