CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10

CVE-2026-23842 Denial of Service via Database Connection Pool Exhaustion in ≤ 1.2.10 📌 Overview This repository documents my discovery and responsible disclosure of CVE-2026-23842 , a High Severity Denial-of-Service vulnerability in ChatterBot. GitHub Advisory: GHSA-v4w8-49pv-mf72 CVE ID:...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

CVE-2026-58198

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

CVE-2026-58198

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

EUVD-2026-42685

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

CVE-2026-58198

ChatterBot (Python) vulnerability CVE-2026-58198: UbuntuCorpusTrainer.extract() uses a predictable home path (~/.ubuntu_data/ubuntu_dialogs) with a check-then-create pattern, then tar.extractall(path=self.data_path). An attacker who pre-places a symlink at that path can cause archived contents to...

CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

chatterbot-voice (>=0.1.3, <=0.1.5), shynabot (0.0.1) +1 more potentially affected by CVE-2026-58198 via chatterbot (>=0.6.3, <=1.0.4)

chatterbot PYPI version =0.6.3, =0.1.3, =0.1.5 - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-58198 Source advisory: MEND:CVE-2026-58198...

CVE-2026-58198: Time-of-check Time-of-use (TOCTOU) Race Condition

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

PT-2026-56905

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntu data/ubuntu dialogs with a check-then-create pattern followed by tar.extractallpath=self.data path, allowing ...

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

SummaryChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the getresponse method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service...

shynabot (0.0.1), shynataskmanager (0.0.1) potentially affected by CVE-2026-23842 via chatterbot (1.0.4)

chatterbot PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-23842 Source advisory: OSV:PYSEC-2026-1244...

chatterbot-voice (>=0.1.3, <=0.1.5) potentially affected by CVE-2026-23842 via chatterbot (0.6.3)

chatterbot PYPI version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - chatterbot-voice =0.1.3, =0.1.5 Source cves: CVE-2026-23842 Source advisory: OSV:PYSEC-2026-1244...

PYSEC-2026-1244 ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

Summary ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the getresponse method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2024-5629 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2024-5629 Source advisory: OSV:PYSEC-2026-1826...