CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

textproc/opensearch219 2.19.6

Full-text search engine for Java

1
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
opensearch@FreeBSD.org
Packages
latest: 2.19.6
Upstream
up to date
Last update
to 2.19.6 · da73534cf2
Quarterly
2026Q4: 2.19.6
WWW
https://opensearch.org
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install opensearch219
installs 2.19.6 from latest; from quarterly (2026Q4) 2.19.6
Port
# cd /usr/ports/textproc/opensearch219 && make install clean
# make -C /usr/ports/textproc/opensearch219 config  # change options first
Size
739 MiB download · 950 MiB installed
Depends on
devel/jna 5.15.0_4, java/openjdk21 21.0.12+8.2_1, shells/bash 5.3.20
License
APACHE20
Creates
user opensearch, group opensearch
Options
1 of 1 on in the package: PLUGINS
pkg-message
Shown after installing
Opensearch was installed

Please see /usr/local/etc/opensearch for a sample version of
opensearch.yml.

OpenSearch requires memory locking of large amounts of RAM.
You may need to set:

sysctl security.bsd.unprivileged_mlock=1

When running within a jail, it's highly advisable to set:

enforce_statfs = 1

for the jail running opensearch instance.

If OpenSearch was built with the PLUGINS option enabled (default) it will not
start until the security plugin is properly configured.  Please refer to the
OpenSearch documentation for setting-up TLS:

https://opensearch.org/docs/security-plugin/configuration/tls

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.19.62.19.6–
FreeBSD 152.19.62.19.6–
FreeBSD 142.19.62.19.6✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.19.62.19.6–
FreeBSD 142.19.62.19.6✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 2.19.6 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-834978.72026-08-31Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search …

VuXML only (0)

Listed in VuXML, the packaged version 2.19.6 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (8)

Jose Alonso Cardenas Marquez (acm) · 2.19.6
textproc/opensearch219: Update to 2.19.6

With hat:       opensearch
da73534cf2
Jose Alonso Cardenas Marquez (acm) · 2.19.5
textproc/opensearch[-dashboards]219: Update to 2.19.5

With hat:       opensearch
f1043c59a2
Ronald Klop (ronald) · 2.19.4_3
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 2.19.4_2
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Jose Alonso Cardenas Marquez (acm) · 2.19.4_1
textproc/opensearch219: Update JAVA_VERSION to 21

- Bump PORTREVISION
a3eecffc32
Jose Alonso Cardenas Marquez (acm) · 2.19.4
textproc/opensearch[-dashboards]219: Update to 2.19.4

With hat:       opensearch
7295cbe294
Jose Alonso Cardenas Marquez (acm) · 2.19.3
textproc/opensearch219: Update to 2.19.3

With hat:       opensearch
ed396786d8
Jose Alonso Cardenas Marquez (acm) · 2.19.1
textproc/opensearch219: New port: Full-text search engine for Java

OpenSearch is a fork of Elasticsearch which aims to be a Distributed,
RESTful, Search Engine built on top of Apache Lucene.
431b97fd68