CVE-2026-78321— DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
Quick assessment
Affected
DJI Neo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
大疆（DJI）无人机的 HTTP 媒体服务器未对传入连接数或请求速率实施足够的限制。具备无人机内部网络访问权限的攻击者，可以通过反复请求已存储的媒体文件，耗尽服务器的连接池，从而导致合法请求无法被处理，引发拒绝服务（DoS）问题。这将使 DJI Fly 应用程序无法在 QuickTransfer（快速传输）模式下从无人机获取照片和视频。 受影响的机型及固件版本包括： DJI Neo：1.00.0400 及之前版本 DJI Neo 2：1.00.0500 及之前版本 DJI Flip：1.00.1200 及之前版本
Possible ATT&CK Techniques 2 AI
T1210 · Exploitation of Remote Services T1499 · Endpoint Denial of ServiceAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| DJI | Air 3 | ≤ 01.00.1600 |
affected |
| DJI | Air 3S | ≤ 01.00.1400 |
affected |
| DJI | Avata 2 | ≤ 01.00.0400 |
affected |
| DJI | Avata 360 | ≤ 01.00.0300 |
affected |
| DJI | Flip | ≤ 01.00.1200 |
affected |
| DJI | Mavic 3 | ≤ 01.00.1400 |
affected |
| DJI | Mavic 3 Classic | ≤ 01.00.0800 |
affected |
| DJI | Mavic 3 Pro | ≤ 01.01.0700 |
affected |
| DJI | Mavic 4 Pro | ≤ 01.00.0500 |
affected |
| DJI | Mini 2 | ≤ 01.07.0200, |
affected |
| DJI | Mini 3 | ≤ 01.00.0500 |
affected |
| DJI | Mini 3 Pro | ≤ 01.00.0900 |
affected |
| DJI | Mini 4 Pro | ≤ 01.00.1100 |
affected |
| DJI | Mini 5 Pro | ≤ 01.00.0600 |
affected |
| DJI | Neo | ≤ 01.00.0400, |
affected |
| DJI | Neo 2 | ≤ 01.00.0500 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78321
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DJI | Neo | 0 ~ 01.00.0400, | - |
|
| DJI | Neo 2 | 0 ~ 01.00.0500 | - |
|
| DJI | Flip | 0 ~ 01.00.1200 | - |
|
| DJI | Air 3 | 0 ~ 01.00.1600 | - |
|
| DJI | Air 3S | 0 ~ 01.00.1400 | - |
|
| DJI | Avata 2 | 0 ~ 01.00.0400 | - |
|
| DJI | Avata 360 | 0 ~ 01.00.0300 | - |
|
| DJI | Mavic 3 | 0 ~ 01.00.1400 | - |
|
| DJI | Mavic 3 Classic | 0 ~ 01.00.0800 | - |
|
| DJI | Mavic 3 Pro | 0 ~ 01.01.0700 | - |
|
| DJI | Mavic 4 Pro | 0 ~ 01.00.0500 | - |
|
| DJI | Mini 2 | 0 ~ 01.07.0200, | - |
|
| DJI | Mini 3 | 0 ~ 01.00.0500 | - |
|
| DJI | Mini 3 Pro | 0 ~ 01.00.0900 | - |
|
| DJI | Mini 4 Pro | 0 ~ 01.00.1100 | - |
|
| DJI | Mini 5 Pro | 0 ~ 01.00.0600 | - |
|
II. Public POCs for CVE-2026-78321
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78321
请登录查看更多情报信息。
Vendor Pages for CVE-2026-78321 (1)
-
🔗 Help Center product
Same Patch Batch · DJI · 2026-08-24 · 4 CVEs total
| CVE-2026-78251 | 9.3 CRITICAL | DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory |
| CVE-2026-78255 | 8.7 HIGH | DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media |
| CVE-2026-78306 | 8.5 HIGH | DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution |
IV. Related Vulnerabilities
Same product: Neo
-
CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command E -
CVE-2026-78255
DJI Drone HTTP Media Server Allows Unauthenticated Access to -
CVE-2026-78251
DJI Drone FTP Service Allows Unrestricted Storage Consumptio -
CVE-2026-77812
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
Same vendor: DJI
-
CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command E -
CVE-2026-78255
DJI Drone HTTP Media Server Allows Unauthenticated Access to -
CVE-2026-78251
DJI Drone FTP Service Allows Unrestricted Storage Consumptio -
CVE-2026-77812
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE -
CVE-2026-1743
DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing auth
Same weakness: CWE-770
-
CVE-2026-55620
eml_parser: DoS via deeply nested parens in Received headers -
CVE-2026-55619
eml_parser: Parser DoS via deeply nested parentheses in e-ma -
CVE-2026-63075
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion -
CVE-2026-63074
CMP Indefinite Cache Growth of ExtraCerts -
CVE-2026-79661
Ech0 before 4.7.3 Unauthenticated fav_count Modification
V. Comments for CVE-2026-78321
No comments yet