CVE and update status of the FreeBSD ports tree3,788 unaddressed CVEs in 710 portsAll times are CET
Port details

textproc/elasticsearch94 9.4.9_1

Distributed, RESTful search and analytics engine (9 version)

Port info

Maintainer
elastic@FreeBSD.org
Packages
latest: 9.4.9, update to 9.4.9_1 not built yet
Upstream
up to date
Last update
to 9.4.9_1 · 2d01032b0f
Quarterly
not in the 2026Q4 packages
WWW
https://www.elastic.co/
CPE
Elastic Elasticsearch
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install elasticsearch94
installs 9.4.9 from latest
Port
# cd /usr/ports/textproc/elasticsearch94 && make install clean
# make -C /usr/ports/textproc/elasticsearch94 config  # change options first
Size
385 MiB download · 443 MiB installed
License
AGPLv3 and APACHE20 and EL20 and SSPLv1
Creates
user elasticsearch, group elasticsearch
Options
2 of 2 on in the package: DOCS LIBVEC
pkg-message
Shown after installing
Elasticsearch-specific utilities are symlinked into /usr/local/bin.

Please see /usr/local/etc/elasticsearch for a sample version of elasticsearch.yml.

For optimal performance, Elasticsearch requires locking large amounts of RAM.
Therefore, it is advisable to set the following in /etc/sysctl.conf:

  security.bsd.unprivileged_mlock=1

When running within a jail, it's highly advisable to set:

  enforce_statfs = 1

for the jail running the Elasticsearch instance.

!!! PLUGINS NOTICE !!!

Elasticsearch plugins should only be installed via the elasticsearch-plugin
included with this software. As we strive to provide a minimum semblance
of security, the files installed by the package are owned by root:wheel.
This is different than upstream which expects all of the files to be
owned by the user and for you to execute the elasticsearch-plugin script
as said user.

You will encounter permissions errors with configuration files and
directories created by plugins which you will have to manually correct.
This is the price we have to pay to protect ourselves in the face of
a poorly designed security model.

e.g. After modifying the keystore, or installing a plugin, you may have to run:

chown elasticsearch:elasticsearch /usr/local/etc/elasticsearch/elasticsearch.keystore
chown -R elasticsearch:elasticsearch /usr/local/etc/elasticsearch/plugin

!!! PLUGINS NOTICE !!!

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 16✗✗–
FreeBSD 15✗✗–
FreeBSD 14✗✗✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 15✗✗–
FreeBSD 14✗✗✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Dependencies

Depends on 3

Run and library dependencies of the package on latest. Build dependencies are not in the package index.

Required by 0

No package on latest depends on it.

Packages on latest that depend on it directly.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 9.4.9.

Fixed (37)

Show 37 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-726498.82026-09-01Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A special…
CVE-2026-726428.82026-08-13The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset…
CVE-2026-1152907.52026-11-03Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with ne…
CVE-2026-1030077.22026-10-06Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during aut…
CVE-2026-1030097.12026-10-06Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that …
CVE-2026-1157156.52026-11-03Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an…
CVE-2026-1030086.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply …
CVE-2026-1024116.52026-10-06Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforce…
CVE-2026-1030056.52026-10-06Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with con…
CVE-2026-1030066.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of th…
CVE-2026-1024046.52026-10-06Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can …
CVE-2026-1024096.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service,…
CVE-2026-943996.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943986.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943976.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943966.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-823006.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-822946.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-726866.52026-08-13A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component val…
CVE-2026-726876.52026-08-13A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and dese…
CVE-2026-726846.52026-08-13A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing t…
CVE-2026-726786.52026-08-13Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticate…
CVE-2026-726796.52026-08-13Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drive…
CVE-2026-726836.52026-08-13A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elast…
CVE-2026-726476.52026-08-13Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only …
CVE-2026-726456.52026-08-13Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding …
CVE-2026-726396.52026-08-13Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accoun…
CVE-2026-726386.52026-08-13Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privilege…
CVE-2026-726366.52026-08-13Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to …
CVE-2026-786055.92026-09-01Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-3…
CVE-2026-1024075.42026-10-06Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…
CVE-2026-786075.42026-09-01Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inf…
CVE-2026-944084.92026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-1152984.32026-11-03Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenti…
CVE-2026-1024084.32026-10-06Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUN…
CVE-2026-726854.32026-08-13A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Pr…
CVE-2026-1157104.22026-11-03Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search req…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (4)

Vladimir Druzenko (vvd) · 9.4.9_1
textproc/elasticsearch94: Use LOCALBASE in path to protoc

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
2d01032b0f
Vladimir Druzenko (vvd) · 9.4.9
textproc/elasticsearch94: Improving adherence to the coding style in the patches

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
7b17638111
Vladimir Druzenko (vvd) · 9.4.9
textproc/elasticsearch94: New port: Distributed, RESTful search and analytics engine 9.4.x

Release Notes:
https://www.elastic.co/docs/release-notes/elasticsearch#elasticsearch-9.4.9-release-notes

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs (vvd)
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
6dbf601137
Vladimir Druzenko (vvd) · 8.19.24
textproc/elasticsearch94: Repocopy from textproc/elasticsearch8

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
db43f9cfd4