CVE-2026-23842

Katalog CVE

CVSS 7.5 · High EPSS 0,55%

Kerentanan Uncontrolled Resource Consumption pada chatterbot. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.

Rincian

Terbit di NVD

19 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-v4w8-49pv-mf72 exploit · advisory vendor
• https://github.com/gunthercox/ChatterBot/commit/de89fe648139f8eeacc998ad4524fab291a378cf patch
• https://github.com/user-attachments/assets/4ee845c4-b847-4854-84ec-4b2fb2f7090f exploit
• https://github.com/gunthercox/ChatterBot/pull/2432 issue tracking
• https://github.com/gunthercox/ChatterBot/releases/tag/1.2.11 product · release notes