Denial-of-Service Vulnerability in ChatterBot by Gunther Cox
CVE-2026-23842
Key Information:
- Vendor
Gunthercox
- Status
- Vendor
- CVE Published:
- 19 January 2026
Badges
What is CVE-2026-23842?
ChatterBot, a machine learning conversational dialog engine, is susceptible to a denial-of-service condition due to inadequate management of database sessions and connection pools. This vulnerability occurs when multiple instances of the get_response() method are invoked simultaneously, which can deplete the underlying SQLAlchemy connection pool, leading to persistent service disruptions. A manual restart of the service is required for recovery. Users are encouraged to upgrade to version 1.2.11, which addresses this issue effectively.
Affected Version(s)
ChatterBot < 1.2.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.