# CVE-2026-78321: DJI drone HTTP media server denial of service via connection exhaustion

Source: https://junglewise.ai/threats/cve-2026-78321-dji-drone-http-media-server-denial-of-service-via-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78321 · Severity: info · Published 2026-08-24

DJI drones include an HTTP media server that transfers photos and videos to the DJI Fly mobile app. The server lacks rate limiting on incoming connections, allowing an attacker on the drone's network to flood it with requests and crash the service, preventing users from retrieving their media files and interrupting normal operations.

Technologies: [DJI Air 3](https://junglewise.ai/threats/technologies/air-3), [DJI Air 3S](https://junglewise.ai/threats/technologies/air-3s), [DJI Avata 2](https://junglewise.ai/threats/technologies/avata-2), [DJI Avata 360](https://junglewise.ai/threats/technologies/avata-360), [DJI Flip](https://junglewise.ai/threats/technologies/flip), [DJI Mavic 3](https://junglewise.ai/threats/technologies/mavic-3), [DJI Mavic 3 Classic](https://junglewise.ai/threats/technologies/mavic-3-classic), [DJI Mavic 3 Pro](https://junglewise.ai/threats/technologies/mavic-3-pro), [DJI Mavic 4 Pro](https://junglewise.ai/threats/technologies/mavic-4-pro), [DJI Mini 2](https://junglewise.ai/threats/technologies/mini-2), [DJI Mini 3](https://junglewise.ai/threats/technologies/mini-3), [DJI Mini 3 Pro](https://junglewise.ai/threats/technologies/mini-3-pro), [DJI Mini 4 Pro](https://junglewise.ai/threats/technologies/mini-4-pro), [DJI Mini 5 Pro](https://junglewise.ai/threats/technologies/mini-5-pro), [DJI Neo](https://junglewise.ai/threats/technologies/neo), [DJI Neo 2](https://junglewise.ai/threats/technologies/neo-2). Vendors: [DJI](https://junglewise.ai/threats/vendors/dji).

## Quick answers

**Is CVE-2026-78321 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78321 being exploited in the wild.

**How severe is CVE-2026-78321?** Informational severity, published 24 August 2026.

**Which products and versions are affected?** DJI Air 3 before 01.00.1600; DJI Air 3S before 01.00.1400; DJI Avata 2 before 01.00.0400; DJI Avata 360 before 01.00.0300; and 12 more.

**Is there a fix for CVE-2026-78321?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78321 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-78321?** Check whether you run DJI Air 3, DJI Air 3S, DJI Avata 2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial of service (DoS) condition in the HTTP media server component of DJI drone firmware caused by insufficient connection and request rate limits. An attacker with network access to the drone can exhaust the server's connection pool by repeatedly requesting stored media files, causing the server to drop legitimate requests from the DJI Fly application. The attack requires local network access (adjacent network vector) and impacts the QuickTransfer media retrieval mode. Patches are available via firmware updates for all affected models.

## Affected products

- DJI Neo before 01.00.0400
- DJI Neo 2 before 01.00.0500
- DJI Flip before 01.00.1200
- DJI Air 3 before 01.00.1600
- DJI Air 3S before 01.00.1400
- DJI Avata 2 before 01.00.0400
- DJI Avata 360 before 01.00.0300
- DJI Mavic 3 before 01.00.1400
- DJI Mavic 3 Classic before 01.00.0800
- DJI Mavic 3 Pro before 01.01.0700
- DJI Mavic 4 Pro before 01.00.0500
- DJI Mini 2 before 01.07.0200
- DJI Mini 3 before 01.00.0500
- DJI Mini 3 Pro before 01.00.0900
- DJI Mini 4 Pro before 01.00.1100
- DJI Mini 5 Pro before 01.00.0600

## Timeline

- 2026-08-24: disclosed

## References

- [https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en](https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en)

## Related threats

- [DJI drones unauthenticated storage exhaustion via hardcoded FTP credentials](https://junglewise.ai/threats/cve-2026-78251-dji-drones-unauthenticated-storage-exhaustion-via-hardcoded-ftp)
- [DJI drones Bluetooth unauthenticated DUML command injection](https://junglewise.ai/threats/cve-2026-78306-dji-drones-bluetooth-unauthenticated-duml-command-injection)
- [DJI drones HTTP media server unauthenticated photo and video access](https://junglewise.ai/threats/cve-2026-78255-dji-drones-http-media-server-unauthenticated-photo-and-video)
- [DJI drones unencrypted DUML protocol messages over Bluetooth LE](https://junglewise.ai/threats/cve-2026-77812-dji-drones-unencrypted-duml-protocol-messages-over-bluetooth-le)