CVE-2026-78321: DJI Drone HTTP Media Server DoS Vulnerability

CVE-2026-78321 Overview

CVE-2026-78321 is a denial of service vulnerability in the HTTP media server running on DJI drones. The server does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can repeatedly request a stored media file to exhaust the server's connection pool. Once exhausted, the server cannot handle legitimate requests, preventing the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode. The weakness is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling) and requires adjacent network access. Firmware updates from DJI are required for remediation.

Critical Impact
An adjacent-network attacker can render the drone's QuickTransfer media retrieval unusable by flooding the HTTP media server with concurrent requests, blocking legitimate DJI Fly transfers.

Affected Products

DJI Neo (until 01.00.0400), DJI Neo 2 (until 01.00.0500), DJI Flip (until 01.00.1200)
DJI Air 3 (until 01.00.1600), DJI Air 3S (until 01.00.1400), DJI Avata 2 (until 01.00.0400), DJI Avata 360 (until 01.00.0300)
DJI Mavic 3 (until 01.00.1400), Mavic 3 Classic (until 01.00.0800), Mavic 3 Pro (until 01.01.0700), Mavic 4 Pro (until 01.00.0500), DJI Mini 2 (until 01.07.0200), Mini 3 (until 01.00.0500), Mini 3 Pro (until 01.00.0900), Mini 4 Pro (until 01.00.1100), Mini 5 Pro (until 01.00.0600)

Discovery Timeline

2026-08-24 - CVE-2026-78321 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78321

Vulnerability Analysis

The HTTP media server exposed by affected DJI drones serves stored photos and videos to the DJI Fly mobile application over QuickTransfer, a Wi-Fi based transfer mode. The server accepts client connections without imposing per-client concurrency limits, global connection caps, or request rate throttling. An attacker on the same Wi-Fi network can therefore open many parallel HTTP requests for a media file and hold them long enough to saturate the server's connection pool. Legitimate DJI Fly sessions then fail to obtain a connection slot, breaking media synchronization. The condition is a classic resource exhaustion denial of service and does not compromise confidentiality or integrity of the drone's data.

Root Cause

The root cause is the absence of resource governance on the embedded HTTP server, aligning with [CWE-770]. The server neither caps the number of simultaneous connections per source, nor enforces a request-per-second ceiling, nor times out idle or slow reads aggressively enough to reclaim slots. Because the connection pool is finite on embedded firmware, a modest volume of requests is sufficient to keep every worker occupied.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be associated with the drone's Wi-Fi network during QuickTransfer. From that position, an attacker issues repeated GET requests for a known stored media resource. No authentication or user interaction is required, and the attacker gains no code execution or data disclosure. Impact is limited to availability of the media transfer function while the flood is sustained.

No public proof-of-concept exploit is available. Refer to the DJI Support Content advisory for vendor technical details.

Detection Methods for CVE-2026-78321

Indicators of Compromise

Sustained inability of the DJI Fly application to enumerate or download media in QuickTransfer mode while the drone appears otherwise responsive.
A high count of concurrent TCP sessions to the drone's HTTP media server port originating from a single Wi-Fi client.
Repeated identical HTTP GET requests for the same media resource within a short time window.

Detection Strategies

Passively monitor the drone's Wi-Fi segment for abnormal connection counts or request rates against the media server endpoint.
Correlate DJI Fly transfer failures with the presence of unknown or untrusted Wi-Fi clients associated with the aircraft.
Baseline normal QuickTransfer traffic volume so that flood conditions stand out against expected client behavior.

Monitoring Recommendations

Log the set of stations that associate with the drone's Wi-Fi network during field operations, and alert on unexpected clients.
Track application-layer errors reported by DJI Fly during transfers and treat repeated failures as an availability signal worth investigation.
If operating drones in professional environments, capture wireless traffic during incidents to preserve evidence of connection floods.

How to Mitigate CVE-2026-78321

Immediate Actions Required

Update every affected DJI aircraft to a firmware version at or above the fixed release listed for that model.
Perform QuickTransfer operations only in trusted radio environments and avoid crowded or public Wi-Fi areas where adjacent access is possible.
Disable QuickTransfer when not actively needed to reduce the exposure window of the HTTP media server.

Patch Information

DJI has issued firmware updates that resolve the resource exhaustion condition. Users must upgrade past the vulnerable versions enumerated above for each model, for example DJI Neo beyond 01.00.0400, DJI Mavic 4 Pro beyond 01.00.0500, and DJI Mini 5 Pro beyond 01.00.0600. Full model-by-model fixed versions are documented in the DJI Support Content advisory. Firmware upgrades are the only supported remediation path.

Workarounds

Use a strong, unique Wi-Fi password for the drone and rotate it if compromise is suspected, limiting who can reach the media server.
Prefer wired or SD-card media retrieval workflows over QuickTransfer where operationally feasible until firmware is applied.
Restart the aircraft to reclaim exhausted connection slots after a suspected flood, then apply firmware updates before further use.

bash

# Verify current firmware version in DJI Fly, then update via the app:
# Settings -> About -> Firmware Update
# Ensure the installed version exceeds the vulnerable ceiling for your model,
# for example DJI Mini 5 Pro must be greater than 01.00.0600.