CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/logstash91 9.1.10_3

Server-side data ingestion and transformation tool (9.1.x version)

Port info

Maintainer
elastic@FreeBSD.org
Packages
latest: 9.1.10_3
Upstream
up to date
Last update
to 9.1.10_3 · c88f965bde
Quarterly
2026Q4: 9.1.10_3
WWW
https://www.elastic.co/products/logstash
Links
cgit · VuXML

Install

Package
# pkg install logstash91
installs 9.1.10_3 from latest; from quarterly (2026Q4) 9.1.10_3
Port
# cd /usr/ports/sysutils/logstash91 && make install clean
Size
192 MiB download · 331 MiB installed
Depends on
java/openjdk25 25.0.4+7.f.1_1, shells/bash 5.3.20
License
APACHE20
Creates
user logstash, group logstash
pkg-message
Shown after installing
Logstash 9.1 was installed.

1) To start Logstash as an agent during system startup, run:

    sysrc logstash_enable="YES"

2) Extra options can be found in the startup script.

3) WARNING: In order for Logstash to work properly,
   procfs needs to be mounted on /proc.
   
   If you have not done it yet, please do the following:
   
           mount -t procfs proc /proc
   
   To make it permanent, you need the following lines in /etc/fstab:
   
           proc    /proc           procfs          rw      0       0
Shown always
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Support for 9.1.x has ended 03 Feb 2026 - use logstash94 or logstash95 instead.

It is scheduled to be removed on or after 2026-12-31.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 169.1.10_39.1.10_3–
FreeBSD 159.1.10_39.1.10_3–
FreeBSD 149.1.10_39.1.10_3✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 159.1.10_39.1.10_3–
FreeBSD 149.1.10_39.1.10_3✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 9.1.10_3 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-334668.12026-04-08Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path…

VuXML only (0)

Listed in VuXML, the packaged version 9.1.10_3 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (10)

Piotr Kubaj (pkubaj) · 9.1.10_3
sysutils/logstash*: enable on powerpc64*

Logstash is all Java, and JRuby falls back to plain Java where it has no
native helpers, like it already does on aarch64. Just exclude the
x86_64 libfixposix everywhere except amd64, not only on aarch64.
c88f965bde
Vladimir Druzenko (vvd) · 9.1.10_3
sysutils/logstash*: Remove non-${ARCH} libs from the package

stage-qa error on aarch64:

=>> Status     sysutils/logstash94 | logstash94-9.4.7: stage-qa
====> Running Q/A tests (stage-qa)
ldd: /usr/bin/ldd32: Exec format error
ld-elf.so.1: /wrkdirs/usr/ports/sysutils/logstash94/work/stage/usr/local/logstash/vendor/jruby/lib/ruby/stdlib/libfixposix/binary/x86_64-freebsd/libfixposix.so: unsupported machine
/wrkdirs/usr/ports/sysutils/logstash94/work/stage/usr/local/logstash/vendor/jruby/lib/ruby/stdlib/libfixposix/binary/x86_64-freebsd/libfixposix.so: exit status 1

PR:		297679
Approved by:	blanket (fix packaging)
Tested by:	fluffy, Boris Korzun <drtr0jan@yandex.ru>
Sponsored by:	UNIS Labs
6ff7cc588d
Vladimir Druzenko (vvd) · 9.1.10_2
sysutils/logstash*: Fix rc script: use LS_JAVA_HOME/LS_JAVA_OPTS instead of JAVA_HOME/JAVA_OPTS

The use of JAVA_HOME and JAVA_OPTS is deprecated.

PR:		297679
Approved by:	blanket (fix runtime)
Sponsored by:	UNIS Labs
Co-authored-by:	Boris Korzun <drtr0jan@yandex.ru>
31a6364f73
Vladimir Druzenko (vvd) · 9.1.10_1
sysutils/logstash*: Parametrize version in pkg-message

The version in pkg-message was not updated when the ports logstash94 and
logstash95 were created.

PR:		297679
Approved by:	elastic (implicit, inactive for several months again)
Sponsored by:	UNIS Labs
bc90dd2b04
Vladimir Druzenko (vvd) · 9.1.10_1
sysutils/logstash91: Deprecate with EXPIRATION_DATE=2026-12-31

Support for 9.1.x has ended 03 Feb 2026 - use logstash94 or logstash95 instead

Approved by:	elastic (implicit, inactive for several months again)
Sponsored by:	UNIS Labs (vvd, commit patch)
3290df8d6d
Vladimir Druzenko (vvd) · 9.1.10_1
sysutils/{beats,logstash}*,textproc/{elasticsearch,kibana}*: Ports unification before adding 9.4

PKGNAMESUFFIX, CONFLICTS, PORTSCOUT, COMMENT, LOGSTASH_JRUBY_VER,
PORTVERSION => DISTVERSION

PR:		293746
Approved by:	girgen (elastic, maintainer)
Sponsored by:	UNIS Labs
351fddeda4
Ronald Klop (ronald) · 9.1.10_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Vladimir Druzenko (vvd) · 9.1.10
sysutils/logstash91: Update 9.1.9 => 9.1.10

Release Notes:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.1.10-release-notes

Improve port:
- Replace PORTVERSION with DISTVERSION.
- Add LOCAL/vvd/elastic to MASTER_SITES for those who can't download due
  to the HTTP error "Forbidden 403".
- Sort USES.
- Adjust JAVA_VERSION to supported LTS 25, 21 and 17.
- Parametrize "logstash" with "${PORTNAME}".
- Adjust CONFLICTS.
- Fix warnings from portclippy.
- Add possibility to use custom user/group.
- Replace RM of bundled JDK and *.bat files with
  EXTRACT_AFTER_ARGS=--exclude.
- Merge CHMODs.
- Replace %%PREFIX%% with %%LOCALBASE%% in rc.d script - bash installed
  in LOCALBASE.

PR:		293787
Approved by:	elastic (maintainer, implicit - inactive for more than 6 months)
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
b76e9cb9c2
Ronald Klop (ronald) · 9.1.9_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Jesús Daniel Colmenares Oviedo (dtxdf) · 9.1.9
sysutils/logstash91: New port: Server-side data ingestion and transformation tool (9.1.x version)

Logstash is an open source, server-side data processing pipeline that
ingests data from a multitude of sources simultaneously, transforms it,
and then sends it to your favorite "stash."

PR:             290985
01dfe41044