CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

textproc/opensearch213 2.13.0_4

Full-text search engine for Java

Port info

Maintainer
opensearch@FreeBSD.org
Packages
latest: 2.13.0_4
Upstream
up to date
Last update
to 2.13.0_4 · 25a9f59042
Quarterly
2026Q4: 2.13.0_4
WWW
https://opensearch.org
Links
cgit · VuXML

Install

Package
# pkg install opensearch213
installs 2.13.0_4 from latest; from quarterly (2026Q4) 2.13.0_4
Port
# cd /usr/ports/textproc/opensearch213 && make install clean
# make -C /usr/ports/textproc/opensearch213 config  # change options first
Size
614 MiB download · 773 MiB installed
Depends on
devel/jna 5.15.0_4, java/openjdk25 25.0.4+7.f.1_1, shells/bash 5.3.20
License
APACHE20
Creates
user opensearch, group opensearch
Options
1 of 1 on in the package: PLUGINS
pkg-message
Shown after installing
Opensearch was installed

Please see /usr/local/etc/opensearch for a sample version of
opensearch.yml.

OpenSearch requires memory locking of large amounts of RAM.
You may need to set:

sysctl security.bsd.unprivileged_mlock=1

When running within a jail, it's highly advisable to set:

enforce_statfs = 1

for the jail running opensearch instance.

If OpenSearch was built with the PLUGINS option enabled (default) it will not
start until the security plugin is properly configured.  Please refer to the
OpenSearch documentation for setting-up TLS:

https://opensearch.org/docs/security-plugin/configuration/tls
Shown always
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Not consumers exists for this port. Wazuh uses textproc/opensearch219.

It is scheduled to be removed on or after 2026-11-30.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.13.0_42.13.0_4–
FreeBSD 152.13.0_42.13.0_4–
FreeBSD 142.13.0_42.13.0_42.13.0_4

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.13.0_42.13.0_4–
FreeBSD 142.13.0_42.13.0_42.13.0_4

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 2.13.0_4 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-834978.72026-08-31Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search …
CVE-2025-96248.32025-11-25A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions …

VuXML only (0)

Listed in VuXML, the packaged version 2.13.0_4 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (5)

Jose Alonso Cardenas Marquez (acm) · 2.13.0_4
textproc/opensearch216: Mark DEPRECATED and set EXPIRATION_DATE

- It affects to slave ports too
- Bump PORTREVISION

With hat:       opensearch
25a9f59042
Ronald Klop (ronald) · 2.13.0_3
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 2.13.0_2
*/*: bump portrevision after java_default=21 update

PR:	272855
3b8618be7c
Jose Alonso Cardenas Marquez (acm) · 2.13.0_1
textproc/opensearch*: Preparing for major update of opensearch ports

- Now opensearch216 and opensearch-dashboards216 are master ports.
  opensearch and opensearch-dashboards can be updated to 3.0 without
  issues with slave ports

With hat:       opensearch
PR:		286647 286648
812aa75d17
Jose Alonso Cardenas Marquez (acm) · 2.13.0
textproc/opensearch213: New port: Full-text search engine for Java (2.13.0)

- This port is necessary for Wazuh >= 4.9.2

Wit hat:	opensearch
36729aa5d8