CVE and update status of the FreeBSD ports tree3,924 unaddressed CVEs in 706 portsAll times are CET
Port details

textproc/elasticsearch95 9.5.6

Distributed, RESTful search and analytics engine (9 version)

Port info

Maintainer
elastic@FreeBSD.org
Packages
latest: 9.5.6
Upstream
up to date
Last update
to 9.5.6 · ef5b674e38
Quarterly
not in the 2026Q4 packages
WWW
https://www.elastic.co/
CPE
Elastic Elasticsearch
Links
cgit · VuXML · Report wrong data

UPDATING

No entry in UPDATING affects this port.

Entries come from UPDATING in the ports tree. They are matched to a port through the AFFECTS line, which is free text, so an entry that names no port (“users of python”) or a port that no longer exists is not shown anywhere.

Install

Package
# pkg install elasticsearch95
installs 9.5.6 from latest
Port
# cd /usr/ports/textproc/elasticsearch95 && make install clean
# make -C /usr/ports/textproc/elasticsearch95 config  # change options first
Size
408 MiB download · 470 MiB installed
License
AGPLv3 and APACHE20 and EL20 and SSPLv1
Creates
user elasticsearch, group elasticsearch
Options
2 of 2 on in the package: DOCS LIBVEC
pkg-message
Shown after installing
Elasticsearch-specific utilities are symlinked into /usr/local/bin.

Please see /usr/local/etc/elasticsearch for a sample version of elasticsearch.yml.

For optimal performance, Elasticsearch requires locking large amounts of RAM.
Therefore, it is advisable to set the following in /etc/sysctl.conf:

  security.bsd.unprivileged_mlock=1

When running within a jail, it's highly advisable to set:

  enforce_statfs = 1

for the jail running the Elasticsearch instance.

!!! PLUGINS NOTICE !!!

Elasticsearch plugins should only be installed via the elasticsearch-plugin
included with this software. As we strive to provide a minimum semblance
of security, the files installed by the package are owned by root:wheel.
This is different than upstream which expects all of the files to be
owned by the user and for you to execute the elasticsearch-plugin script
as said user.

You will encounter permissions errors with configuration files and
directories created by plugins which you will have to manually correct.
This is the price we have to pay to protect ourselves in the face of
a poorly designed security model.

e.g. After modifying the keystore, or installing a plugin, you may have to run:

chown elasticsearch:elasticsearch /usr/local/etc/elasticsearch/elasticsearch.keystore
chown -R elasticsearch:elasticsearch /usr/local/etc/elasticsearch/plugin

!!! PLUGINS NOTICE !!!

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 16✗✗–
FreeBSD 15✗✗–
FreeBSD 14✗✗✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 15✗✗–
FreeBSD 14✗✗✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Dependencies

Depends on 3

Run and library dependencies of the package on latest. Build dependencies are not in the package index.

Required by 0

No package on latest depends on it.

Packages on latest that depend on it directly.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 9.5.6.

Fixed (20)

Show 20 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-1152907.52026-11-03Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with ne…
CVE-2026-1030077.22026-10-06Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during aut…
CVE-2026-1030097.12026-10-06Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that …
CVE-2026-1157156.52026-11-03Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an…
CVE-2026-1030086.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply …
CVE-2026-1024116.52026-10-06Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforce…
CVE-2026-1030056.52026-10-06Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with con…
CVE-2026-1030066.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of th…
CVE-2026-1024046.52026-10-06Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can …
CVE-2026-1024096.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service,…
CVE-2026-943966.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943976.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943986.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943996.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-822946.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-823006.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-944084.92026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-1152984.32026-11-03Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenti…
CVE-2026-1024084.32026-10-06Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUN…
CVE-2026-1157104.22026-11-03Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search req…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (2)

Vladimir Druzenko (vvd) · 9.5.6
textproc/elasticsearch95: New port: Distributed, RESTful search and analytics engine 9.5.x

Release Notes:
https://www.elastic.co/docs/release-notes/elasticsearch#elasticsearch-9.5.6-release-notes

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs (vvd)
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
ef5b674e38
Vladimir Druzenko (vvd) · 9.4.9_1
textproc/elasticsearch95: Repocopy from textproc/elasticsearch94

PR:		290954
Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
b250184452