The vulnerability in ChatterBot versions up to 1.2.10 arises from improper handling of SQLAlchemy database sessions and the underlying connection pool. Concurrent calls to the get_response() method can exhaust the pool, causing the bot to become unavailable until a manual restart is performed. This is a resource exhaustion flaw (CWE-400) that results in denial of service, disrupting availability for legitimate users.

The affected product is ChatterBot, a conversation engine developed by gunthercox. Versions up to 1.2.10 are vulnerable; the issue was fixed in version 1.2.11. No other dependent libraries or platforms are specifically mentioned.

The CVSS score of 7.5 indicates a medium‑high severity level, though the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service by sending a high volume of requests to the bot’s get_response() endpoint, typically over a network interface that exposes the bot. In practice, the attack vector would be remote, leveraging the bot’s public API or webhooks, assuming the bot is accessible over the internet. Without a publicly documented exploit, a successful attack would require an active user session or the ability to invoke the get_response() method repeatedly.