textproc/elasticsearch94: Use LOCALBASE in path to protoc PR: 290954 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs2d01032b0f
Port details
textproc/elasticsearch94 9.4.9_1
Distributed, RESTful search and analytics engine (9 version)
Port info
- Maintainer
- elastic@FreeBSD.org
- Packages
- latest: 9.4.9, update to 9.4.9_1 not built yet
- Upstream
- up to date
- Last update
- to 9.4.9_1 · 2d01032b0f
- Quarterly
- not in the 2026Q4 packages
- WWW
- https://www.elastic.co/
- CPE
- Elastic Elasticsearch
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install elasticsearch94installs 9.4.9 fromlatest- Port
# cd /usr/ports/textproc/elasticsearch94 && make install clean# make -C /usr/ports/textproc/elasticsearch94 config # change options first
- Size
- 385 MiB download · 443 MiB installed
- License
- AGPLv3 and APACHE20 and EL20 and SSPLv1
- Creates
- user
elasticsearch, groupelasticsearch - Options
- 2 of 2 on in the package: DOCS LIBVEC
- pkg-message
Shown after installing
Elasticsearch-specific utilities are symlinked into /usr/local/bin. Please see /usr/local/etc/elasticsearch for a sample version of elasticsearch.yml. For optimal performance, Elasticsearch requires locking large amounts of RAM. Therefore, it is advisable to set the following in /etc/sysctl.conf: security.bsd.unprivileged_mlock=1 When running within a jail, it's highly advisable to set: enforce_statfs = 1 for the jail running the Elasticsearch instance. !!! PLUGINS NOTICE !!! Elasticsearch plugins should only be installed via the elasticsearch-plugin included with this software. As we strive to provide a minimum semblance of security, the files installed by the package are owned by root:wheel. This is different than upstream which expects all of the files to be owned by the user and for you to execute the elasticsearch-plugin script as said user. You will encounter permissions errors with configuration files and directories created by plugins which you will have to manually correct. This is the price we have to pay to protect ourselves in the face of a poorly designed security model. e.g. After modifying the keystore, or installing a plugin, you may have to run: chown elasticsearch:elasticsearch /usr/local/etc/elasticsearch/elasticsearch.keystore chown -R elasticsearch:elasticsearch /usr/local/etc/elasticsearch/plugin !!! PLUGINS NOTICE !!!
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | ✗ | ✗ | – |
| FreeBSD 15 | ✗ | ✗ | – |
| FreeBSD 14 | ✗ | ✗ | ✗ |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | ✗ | ✗ | – |
| FreeBSD 14 | ✗ | ✗ | ✗ |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Dependencies
Depends on 3
- devel/jna 5.15.0_4
- java/openjdk25 25.0.5.0.3+1.f.1_1
- shells/bash 5.3.20
Run and library dependencies of the package on latest. Build dependencies are not in the package index.
Required by 0
No package on latest depends on it.
Packages on latest that depend on it directly.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 9.4.9.Fixed (37)
Show 37 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-72649 | 8.8 | 2026-09-01 | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A special… |
| CVE-2026-72642 | 8.8 | 2026-08-13 | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset… |
| CVE-2026-115290 | 7.5 | 2026-11-03 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with ne… |
| CVE-2026-103007 | 7.2 | 2026-10-06 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during aut… |
| CVE-2026-103009 | 7.1 | 2026-10-06 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that … |
| CVE-2026-115715 | 6.5 | 2026-11-03 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an… |
| CVE-2026-103008 | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply … |
| CVE-2026-102411 | 6.5 | 2026-10-06 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforce… |
| CVE-2026-103005 | 6.5 | 2026-10-06 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with con… |
| CVE-2026-103006 | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of th… |
| CVE-2026-102404 | 6.5 | 2026-10-06 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can … |
| CVE-2026-102409 | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service,… |
| CVE-2026-94399 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-94398 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-94397 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-94396 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-82300 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
| CVE-2026-82294 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
| CVE-2026-72686 | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component val… |
| CVE-2026-72687 | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and dese… |
| CVE-2026-72684 | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing t… |
| CVE-2026-72678 | 6.5 | 2026-08-13 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticate… |
| CVE-2026-72679 | 6.5 | 2026-08-13 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drive… |
| CVE-2026-72683 | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elast… |
| CVE-2026-72647 | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only … |
| CVE-2026-72645 | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding … |
| CVE-2026-72639 | 6.5 | 2026-08-13 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accoun… |
| CVE-2026-72638 | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privilege… |
| CVE-2026-72636 | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to … |
| CVE-2026-78605 | 5.9 | 2026-09-01 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-3… |
| CVE-2026-102407 | 5.4 | 2026-10-06 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… |
| CVE-2026-78607 | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inf… |
| CVE-2026-94408 | 4.9 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-115298 | 4.3 | 2026-11-03 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenti… |
| CVE-2026-102408 | 4.3 | 2026-10-06 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUN… |
| CVE-2026-72685 | 4.3 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Pr… |
| CVE-2026-115710 | 4.2 | 2026-11-03 | Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search req… |
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (4)
textproc/elasticsearch94: Improving adherence to the coding style in the patches PR: 290954 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs7b17638111
textproc/elasticsearch94: New port: Distributed, RESTful search and analytics engine 9.4.x Release Notes: https://www.elastic.co/docs/release-notes/elasticsearch#elasticsearch-9.4.9-release-notes PR: 290954 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs (vvd) Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>6dbf601137
textproc/elasticsearch94: Repocopy from textproc/elasticsearch8 PR: 290954 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labsdb43f9cfd4