DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

Summary

CVE	CVE-2026-78321
State	PUBLISHED
Assigner	CIRCL
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-24 09:16:47 UTC
Updated	2026-08-24 09:16:47 UTC
Description	The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

Risk And Classification

Primary CVSS: v4.0 6 MEDIUM from 5a6e4751-2f3f-4070-9419-94fb35b644e8

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-770 | CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling

Version	Source	Type	Score	Severity	Vector
4.0	5a6e4751-2f3f-4070-9419-94fb35b644e8	Secondary	6	MEDIUM	`CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	6	MEDIUM	`CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

CVSS v4.0 Breakdown

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Confidentiality

None

Integrity

None

Availability

High

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	DJI	Neo	affected 01.00.0400, semver	Not specified
CNA	DJI	Neo 2	affected 01.00.0500 semver	Not specified
CNA	DJI	Flip	affected 01.00.1200 semver	Not specified
CNA	DJI	Air 3	affected 01.00.1600 semver	Not specified
CNA	DJI	Air 3S	affected 01.00.1400 semver	Not specified
CNA	DJI	Avata 2	affected 01.00.0400 semver	Not specified
CNA	DJI	Avata 360	affected 01.00.0300 semver	Not specified
CNA	DJI	Mavic 3	affected 01.00.1400 semver	Not specified
CNA	DJI	Mavic 3 Classic	affected 01.00.0800 semver	Not specified
CNA	DJI	Mavic 3 Pro	affected 01.01.0700 semver	Not specified
CNA	DJI	Mavic 4 Pro	affected 01.00.0500 semver	Not specified
CNA	DJI	Mini 2	affected 01.07.0200, semver	Not specified
CNA	DJI	Mini 3	affected 01.00.0500 semver	Not specified
CNA	DJI	Mini 3 Pro	affected 01.00.0900 semver	Not specified
CNA	DJI	Mini 4 Pro	affected 01.00.1100 semver	Not specified
CNA	DJI	Mini 5 Pro	affected 01.00.0600 semver	Not specified

References

Reference	Source	Link	Tags
support.dji.com/help/content	5a6e4751-2f3f-4070-9419-94fb35b644e8	support.dji.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Abdelrahman Yousef (en)

CNA: Dr. Jordan Samhi (en)

There are currently no legacy QID mappings associated with this CVE.