CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

textproc/opensearch216 2.16.0_3

Full-text search engine for Java

2
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
opensearch@FreeBSD.org
Packages
latest: 2.16.0_3
Upstream
up to date
Last update
to 2.16.0_3 · 25a9f59042
Quarterly
2026Q4: 2.16.0_3
WWW
https://opensearch.org
Links
cgit · VuXML

Install

Package
# pkg install opensearch216
installs 2.16.0_3 from latest; from quarterly (2026Q4) 2.16.0_3
Port
# cd /usr/ports/textproc/opensearch216 && make install clean
# make -C /usr/ports/textproc/opensearch216 config  # change options first
Size
636 MiB download · 789 MiB installed
Depends on
devel/jna 5.15.0_4, java/openjdk25 25.0.4+7.f.1_1, shells/bash 5.3.20
License
APACHE20
Creates
user opensearch, group opensearch
Options
1 of 1 on in the package: PLUGINS
pkg-message
Shown after installing
Opensearch was installed

Please see /usr/local/etc/opensearch for a sample version of
opensearch.yml.

OpenSearch requires memory locking of large amounts of RAM.
You may need to set:

sysctl security.bsd.unprivileged_mlock=1

When running within a jail, it's highly advisable to set:

enforce_statfs = 1

for the jail running opensearch instance.

If OpenSearch was built with the PLUGINS option enabled (default) it will not
start until the security plugin is properly configured.  Please refer to the
OpenSearch documentation for setting-up TLS:

https://opensearch.org/docs/security-plugin/configuration/tls
Shown always
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Not consumers exists for this port. Wazuh uses textproc/opensearch219.

It is scheduled to be removed on or after 2026-11-30.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.16.0_32.16.0_3–
FreeBSD 152.16.0_32.16.0_3–
FreeBSD 142.16.0_32.16.0_32.16.0_3

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.16.0_32.16.0_3–
FreeBSD 142.16.0_32.16.0_32.16.0_3

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 2.16.0_3 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-834978.72026-08-31Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search …
CVE-2025-96248.32025-11-25A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions …

VuXML only (0)

Listed in VuXML, the packaged version 2.16.0_3 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (6)

Jose Alonso Cardenas Marquez (acm) · 2.16.0_3
textproc/opensearch216: Mark DEPRECATED and set EXPIRATION_DATE

- It affects to slave ports too
- Bump PORTREVISION

With hat:       opensearch
25a9f59042
Ronald Klop (ronald) · 2.16.0_2
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 2.16.0_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Jose Alonso Cardenas Marquez (acm) · 2.16.0
textproc/opensearch*: Preparing for major update of opensearch ports

- Now opensearch216 and opensearch-dashboards216 are master ports.
  opensearch and opensearch-dashboards can be updated to 3.0 without
  issues with slave ports

With hat:       opensearch
PR:		286647 286648
812aa75d17
Jose Alonso Cardenas Marquez (acm) · 2.16.0
textproc/opensearch*: Add/bump PORTREVISION

- opensearch-dashboards: Bump PORTREVISION to reflect new CONFLICTS entry
- opensearch-dashboards216 and opensearch216 set PORTREVISION to 0:
0c925421ed
Jose Alonso Cardenas Marquez (acm) · 2.16.0
textproc/opensearch*: New opensearch ports

opensearch216: Full-text search engine for Java
opensearch-dashboards216: Visualization dashboards for OpenSearch

These ports are necessary for new version of Wazuh SIEM/XDR (4.10.x)
1f2f38e074