ChatterBot Denial of Service via SQLAlchemy Connection Pool Exhaustion (CVE-2026-23842)

Metadata

Affected Target

Summary

ChatterBot’s default SQLAlchemy storage adapter uses an unbounded/default QueuePool configuration with no concurrency throttling, request rate limiting, or explicit session lifecycle management. When many threads call get_response() concurrently, each checks out a database connection faster than connections are released back to the pool, quickly exhausting the pool’s capacity. Once exhausted, further calls block and eventually raise sqlalchemy.exc.TimeoutError, leaving the bot hung and the hosting service unresponsive until it is manually restarted. The included PoC simply spins up 30 threads that each call get_response() simultaneously against a fresh ChatterBot instance to trigger the exhaustion.

Vulnerability Details

Root Cause

ChatterBot relies on SQLAlchemy for storage but never bounds or throttles concurrent access to get_response(), and the default QueuePool size is small relative to what a public-facing chatbot endpoint can receive, so simultaneous requests exhaust the pool faster than connections are checked back in.

Attack Vector

1. Identify a service that exposes ChatterBot’s get_response() to end users (e.g. a public chatbot API or web-integrated assistant).
2. Send a burst of concurrent requests/messages (the PoC uses 30 threads) to the endpoint with no authentication required.
3. Each request checks out a SQLAlchemy connection from the pool faster than it is released.
4. The pool’s capacity is reached; subsequent requests block and time out.
5. The application hangs or raises TimeoutError, requiring a manual restart to recover.

Impact

Unauthenticated, low-effort denial of service against any service built on ChatterBot <= 1.2.10 that is reachable over the network, resulting in persistent unavailability until manual intervention.

Environment / Lab Setup

Target:   ChatterBot <= 1.2.10 with default SQLAlchemy storage adapter
Attacker: Python 3.x with chatterbot installed; `threading` (stdlib) to fire concurrent get_response() calls

Proof of Concept

PoC Script

See CVE-2026-23842.py in this folder.

1

python3 CVE-2026-23842.py

Spawns 30 concurrent threads, each calling bot.get_response("hello") against a fresh ChatBot("dos-test") instance, exhausting the SQLAlchemy QueuePool and producing TimeoutErrors / application hangs consistent with the DoS condition.

Detection & Indicators of Compromise

sqlalchemy.exc.TimeoutError: QueuePool limit of size X overflow Y reached, connection timed out

Signs of compromise:

• Repeated sqlalchemy.exc.TimeoutError entries in application logs correlated with a burst of near-simultaneous chatbot requests.
• Chatbot-backed service becoming unresponsive or hanging, requiring a manual process restart to recover.
• Spikes in concurrent connections to the ChatterBot service’s backing database shortly before the outage.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/AdityaBhatt3010/CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10 on 2026-07-05.