CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

net/amnezia-kmod 3.1.0.1501000

Amnezia VPN FreeBSD kernel module implementation

0
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
vova@zote.me
Packages
latest: 3.1.0.1501000
Upstream
up to date
Last update
to 3.1.0.1501000 · d0f1961585
Quarterly
2026Q4: 3.1.0.1501000
WWW
https://docs.amnezia.org/documentation/amnezia-wg
Links
cgit · VuXML

Install

Package
# pkg install amnezia-kmod
installs 3.1.0.1501000 from latest; from quarterly (2026Q4) 3.1.0.1501000
Port
# cd /usr/ports/net/amnezia-kmod && make install clean
Size
42 KiB download · 138 KiB installed
Depends on
nothing
License
MIT

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.1.0.16000293.1.0.1600027–
FreeBSD 153.1.0.15010003.1.0.1501000–
FreeBSD 143.1.0.14040003.1.0.14040003.1.0.1404000

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.1.0.15010003.1.0.1501000–
FreeBSD 143.1.0.14040003.1.0.14040003.1.0.1404000

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.1.0.1501000.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (7)

Yusuf Yaman (nxjoseph) · 3.1.0.1501000
net/amnezia-kmod: Update 2.0.12 => 3.1.0

Changelog:
* if_amn: add AmneziaWG v3 protocol support
* Extend the FreeBSD kernel module with the protocol and configuration
  features required for interoperability with AmneziaWG v3, while retaining
  compatibility with existing AWG2 userspace.
* Implement AWG3 header protection using a small standalone ChaCha20-IETF
  implementation. Use the random junk prefix as the 96-bit nonce and apply
  header protection to handshake, cookie, and transport headers. Require
  S1-S4 to provide enough nonce material whenever a header protection key
  is configured. Add a known-answer ChaCha20 self-test to the module's
  existing cryptographic self-test suite.
* Add support for the new AWG3 configuration parameters:
  - HeaderProtectionKey
  - ContentPaddingAddition
  - RekeyAfterTime
  - RekeyTimeout
  - RejectAfterTime
  - KeepaliveTimeout
  - MaxHandshakeAttempts
  - RandomTrailers
  - DisableCookies
https://github.com/vgrebenschikov/wireguard-amnezia-kmod/releases/tag/v3.1.0

Commit log:
https://github.com/vgrebenschikov/wireguard-amnezia-kmod/compare/v2.0.12...v3.1.0

PR:		298909
Approved by:	osa, vvd (Mentors, implicit)
d0f1961585
Vladimir Druzenko (vvd) · 2.0.12 MFH 2026Q3 ✓
net/amnezia-kmod: Update 2.0.11 => 2.0.12

Changelog:
- if_amn: wg_crypto: validate OCF authentication result.
- Check crp_etype after crypto_dispatch() so packets with an invalid
  Poly1305 tag are rejected.
- Require a synchronous crypto session before using a stack-allocated
  request.
https://github.com/vgrebenschikov/wireguard-amnezia-kmod/releases/tag/v2.0.12

PR:		297625
Security:	CVE-2026-58085
Sponsored by:	UNIS Labs
MFH:		2026Q3
d128f14114
Vladimir Druzenko (vvd) · 2.0.11
net/amnezia-kmod: Update 2.0.10 => 2.0.11

Changelog:
- Fix mbuf leak on processing invalid packets.
https://github.com/vgrebenschikov/wireguard-amnezia-kmod/releases/tag/v2.0.11

PR:		295108
Sponsored by:	UNIS Labs
MFH:		2026Q2
f6e3eec6fb
Eugene Grosbein (eugen) · 2.0.10
net/amnezia-kmod: [maintainer update] v2.0.10

- fix build on FreeBSD-16-CURRENT >= 1600011
- fix build on FreeBSD-13-stable

PR:		292742
d5ad6567ff
Eugene Grosbein (eugen) · 2.0.9
net/amnezia-kmod: update to v2.0.9

PR:		292310
Reported by:	Vladimir Grebenschikov <vova@zote.me> (maintainer)
cdca210e50
Eugene Grosbein (eugen) · 2.0.8
net/amnezia-kmod, net/amnezia-tools: maintainer update

net/amnezia-kmod update from 1.0.8 to 2.0.8;
amnezia-tools updated from 1.0.20241018 to 1.0.20250903.

Original update description:

  Support of AWG2 protocol

  New parameters:
  - s3    - junk before cookie packet
  - s4    - junk before data packet
  - i1-i5 - pre-crafted custom signature packets to be send before hadshake

  Updated logic of packet type recognition
  As s4 may affect interface MTU, handle these limitations properly
  Some fixes on parameters validation
  if_amn now covered with test suite

PR:		291620
0d26b19f26
Eugene Grosbein (eugen) · 1.0.8
net/amnezia-kmod, net/amnezia-tools: new ports

AmneziaWG is a version of the popular VPN protocol, WireGuard.
It offers protection against detection by Deep Packet Inspection
(DPI) systems. At the same time, it retains the simplified
architecture and high performance of the original.

PR:		288599
Approved by:	core (glebius)
618ae04f2c