CVE-2024-6427 is a high severity (CVSS 7.5) denial of service flaw in MESbook 20221021.03. An unauthenticated remote attacker can abuse the "message" parameter so the application keeps sending requests to itself until it is exhausted. No fixed version is named in the record, so contact the vendor and read the INCIBE notice.
What's affected
The NVD record lists MESbook 20221021.03 and nothing else. There are no fixed versions in the record.
Two weakness classes are attached: CWE-400, uncontrolled resource consumption, and CWE-770, allocation of resources without limits or throttling. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the only impact is availability, but it is high and needs no login.
The description says the "message" parameter can carry dangerous JavaScript code that makes the application loop requests back to itself. The advisory stays at that level, and so does this post. It is not in the KEV catalog, and I found no statement that it is being exploited.
This is a sibling of CVE-2024-6426, which is in the same product and the same INCIBE notice.
How to check if you're exposed
- Confirm whether MESbook is deployed and check the build string against 20221021.03.
- Check whether the application is reachable from the internet or from untrusted network segments. The attack needs no account, so reachability is the whole question.
- Read the INCIBE notice for any vendor guidance or fixed release.
- Look at web server logs for bursts of requests that contain the same unusual "message" values, or for requests that originate from the server's own address.
What to do now
- Take the application off the public internet if it is there. Put it behind a VPN or an allow list.
- Ask the vendor for a patched build and a date.
- Add rate limiting at your reverse proxy or web application firewall so one client cannot drive heavy traffic.
- Set up an availability alert on the application so a stall is noticed in minutes, not at shift change.
- Write down the recovery steps. If the app does loop and hang, someone should know how to restart it and in what order.
Why it matters
A stalled business or production application stops the work that depends on it. A denial of service with no authentication is cheap to repeat, so even a modest attacker can keep the system down.
The class of weakness is a missing guard on self-referencing work. When the server will follow instructions in user input that cause it to call itself, nothing bounds the number of calls. Fixes add validation on the parameter and a cap on request depth or rate.
Quick check
Does the attacker need to log in?
No. The record describes an unauthenticated remote attacker, and the vector sets privileges required to none.
Can a rate limiter fix this?
It reduces the damage but is not a fix. Ask the vendor for a patched build, and use rate limits and network restrictions in the meantime.
Sources
- NVD record for CVE-2024-6427
- INCIBE notice: multiple vulnerabilities in MESbook (the page did not load when this post was prepared, so details here come from the NVD record)
Last reviewed: 19 October 2026.
