CVE-2026-78321: DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DJI Neoto a version that resolves this vulnerability.Fixed in 01.00.0400 - Upgrade
Upgrade
DJI Neo 2to a version that resolves this vulnerability.Fixed in 01.00.0500 - Upgrade
Upgrade
DJI Flipto a version that resolves this vulnerability.Fixed in 01.00.1200 - Upgrade
Upgrade
DJI Air 3to a version that resolves this vulnerability.Fixed in 01.00.1600 - Upgrade
Upgrade
DJI Air 3Sto a version that resolves this vulnerability.Fixed in 01.00.1400 - Upgrade
Upgrade
DJI Avata 2to a version that resolves this vulnerability.Fixed in 01.00.0400 - Upgrade
Upgrade
DJI Avata 360to a version that resolves this vulnerability.Fixed in 01.00.0300 - Upgrade
Upgrade
DJI Mavic 3to a version that resolves this vulnerability.Fixed in 01.00.1400 - Upgrade
Upgrade
DJI Mavic 3 Classicto a version that resolves this vulnerability.Fixed in 01.00.0800 - Upgrade
Upgrade
DJI Mavic 3 Proto a version that resolves this vulnerability.Fixed in 01.01.0700 - Upgrade
Upgrade
DJI Mavic 4 Proto a version that resolves this vulnerability.Fixed in 01.00.0500 - Upgrade
Upgrade
DJI Mini 2to a version that resolves this vulnerability.Fixed in 01.07.0200 - Upgrade
Upgrade
DJI Mini 3to a version that resolves this vulnerability.Fixed in 01.00.0500 - Upgrade
Upgrade
DJI Mini 3 Proto a version that resolves this vulnerability.Fixed in 01.00.0900 - Upgrade
Upgrade
DJI Mini 4 Proto a version that resolves this vulnerability.Fixed in 01.00.1100 - Upgrade
Upgrade
DJI Mini 5 Proto a version that resolves this vulnerability.Fixed in 01.00.0600
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to the drone's internal network. The issue affects the HTTP media server used for QuickTransfer media access, rather than requiring Internet exposure.
What functionality is disrupted if exploitation succeeds?
The attacker can exhaust the HTTP media server's connection pool by repeatedly requesting a stored media file. This prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Which firmware versions need remediation?
Affected firmware is earlier than 01.00.0400 for Neo; 01.00.0500 for Neo 2, Mini 3, and Mavic 4 Pro; 01.00.1200 for Flip; 01.00.1600 for Air 3; 01.00.1400 for Air 3S and Mavic 3; 01.00.0400 for Avata 2; 01.00.0300 for Avata 360; 01.00.0800 for Mavic 3 Classic; 01.01.0700 for Mavic 3 Pro; 01.07.0200 for Mini 2; 01.00.0900 for Mini 3 Pro; 01.00.1100 for Mini 4 Pro; and 01.00.0600 for Mini 5 Pro.
What should operators do to remediate the issue?
Install the vendor firmware update for the affected drone model. Until the update is applied, restrict untrusted access to the drone's internal network when using QuickTransfer.