CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

textproc/py-elasticsearch 9.5.1

Official Python low-level client for Elasticsearch

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 9.5.1
Upstream
up to date
Last update
to 9.5.1 · 116161c662
Quarterly
2026Q4: 9.5.1
Formerly
textproc/py-elasticsearch-py until 2017-12-21
WWW
https://www.elastic.co/docs/reference/elasticsearch/clients/python
Links
cgit · VuXML

Install

Package
# pkg install py312-elasticsearch
installs 9.5.1 from latest; from quarterly (2026Q4) 9.5.1
Port
# cd /usr/ports/textproc/py-elasticsearch && make install clean
# make -C /usr/ports/textproc/py-elasticsearch config  # change options first
Size
876 KiB download · 18 MiB installed
Depends on
devel/py-anyio 4.15.1, devel/py-python-dateutil 2.9.0, devel/py-sniffio 1.3.1, devel/py-typing-extensions 4.16.0, lang/python312 3.12.15, textproc/py-elastic-transport 9.4.2, www/py-requests 2.34.2
License
APACHE20
Options
1 of 2 on in the package: REQUESTS
Show the 1 options that are off
ASYNC

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 169.5.19.5.1–
FreeBSD 159.5.19.5.1–
FreeBSD 149.5.19.5.19.5.1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 159.5.19.5.1–
FreeBSD 149.5.19.5.19.5.1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (16)

The CVE record lists the packaged version 9.5.1 as affected, and no VuXML entry names the CVE. What does this mean?

Update to 9.5.5 fixes all 16 unaddressed CVEs.
Fixed up to each version, cumulative: 9.5.2 1 · 9.5.3 4 · 9.5.4 10 · 9.5.5 16
CVECVSSPublishedDescription
CVE-2026-1030077.22026-10-06Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during aut…
CVE-2026-1030097.12026-10-06Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that …
CVE-2026-1030086.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply …
CVE-2026-1024116.52026-10-06Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforce…
CVE-2026-1030056.52026-10-06Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with con…
CVE-2026-1030066.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of th…
CVE-2026-1024046.52026-10-06Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can …
CVE-2026-1024096.52026-10-06Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service,…
CVE-2026-943966.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943976.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943986.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-943996.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-822946.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-823006.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
CVE-2026-944084.92026-09-26Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-1024084.32026-10-06Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUN…

VuXML only (0)

Listed in VuXML, the packaged version 9.5.1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (6)

Show 6 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-726428.82026-08-13The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset…
CVE-2026-726866.52026-08-13A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component val…
CVE-2026-726876.52026-08-13A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and dese…
CVE-2026-726786.52026-08-13Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticate…
CVE-2026-726396.52026-08-13Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accoun…
CVE-2026-726456.52026-08-13Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding …

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (94)

Sunpoet Po-Chuan Hsieh (sunpoet) · 7.11.0
Update to 7.11.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
07e45131fa
Antoine Brodin (antoine) · 7.10.1
Drop python 2.7 support from a few ports

With hat:	portmgr
aa7a6c429e
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.10.1
Update to 7.10.1

- Convert to test framework
- Fix TEST_DEPENDS

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
16c8eadf17
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.10.0
Update to 7.10.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
cf47569620
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.9.1
Update to 7.9.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
65e40e9915
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.9.0
Update to 7.9.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
8a40b934bf
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.8.1
Update to 7.8.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
72f60c6004
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.8.0
Add ASYNC option
034306ab76
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.8.0
Update to 7.8.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
91f6d65760
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.7.1
Update to 7.7.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
643206b465
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.7.0
Update to 7.7.0

- Add LICENSE_FILE

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
c58297311d
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.6.0
Update to 7.6.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
7769977169
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.5.1
Update to 7.5.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
bb5e765a53
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.1.0
Update to 7.1.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
814d7e3fce
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.0.5
Update to 7.0.5

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
b445c06a39
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.0.4
Update to 7.0.4

- Update version requirement of *_DEPENDS

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
		https://github.com/elastic/elasticsearch-py/blob/7.0.4/Changelog.rst
4923b8f2bb
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.4.0
Update to 6.4.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/6.x/Changelog.rst
59768e79b8
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.1
Cosmetic change
b586ec1aa1
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.1
Add TEST_DEPENDS
5dd1ad6800
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.1
Update to 6.3.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
dd4670d654
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.0
Update to 6.3.0

- Add REQUESTS option

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
0f09c333c3
Mathieu Arnold (mat) · 6.2.0
Use PY_FLAVOR for dependencies.

FLAVOR is the current port's flavor, it should not be used outside of
this scope.

Sponsored by:	Absolight
4376dbbb58
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.2.0
Update to 6.2.0

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
38d0c54b17
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.1.1
Update to 6.1.1

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
1fa6bb4643
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.0.0
Update to 6.0.0

- Update pkg-descr
- Update WWW

Changes:	https://github.com/elastic/elasticsearch-py/blob/master/Changelog.rst
f9cb2d25a5
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.4.0
Move textproc/py-elasticsearch-py to textproc/py-elasticsearch

- Change MASTER_SITES from GitHub to CHEESESHOP
- Update dependent ports:
  - Update RUN_DEPENDS
  - Bump PORTREVISION for dependency change
- Take maintainership
36898895fc
Mathieu Arnold (mat) · 5.4.0 · as textproc/py-elasticsearch-py
Convert Python ports to FLAVORS.

Ports using USE_PYTHON=distutils are now flavored.  They will
  automatically get flavors (py27, py34, py35, py36) depending on what
  versions they support.

  There is also a USE_PYTHON=flavors for ports that do not use distutils
  but need FLAVORS to be set.  A USE_PYTHON=noflavors can be set if
  using distutils but flavors are not wanted.

  A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
  added to cope with Python ports that did not have the Python
  PKGNAMEPREFIX but are flavored.

  USES=python now also exports a PY_FLAVOR variable that contains the
  current python flavor.  It can be used in dependency lines when the
  port itself is not python flavored.  For example, deskutils/calibre.

  By default, all the flavors are generated.  To only generate flavors
  for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
  BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.

  In all the ports with Python dependencies, the *_DEPENDS entries MUST
  end with the flavor so that the framework knows which to build/use.
  This is done by appending '@${PY_FLAVOR}' after the origin (or
  @${FLAVOR} if in a Python module with Python flavors, as the content
  will be the same).  For example:

    RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}

PR:		223071
Reviewed by:	portmgr, python
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D12464
551be3c723
Jimmy Olgeni (olgeni) · 2.4.0 · as textproc/py-elasticsearch-py
Update textproc/py-elasticsearch-py to version 2.4.0; add NO_ARCH.

PR:		211986
Submitted by:	olgeni
Approved by:	maintainer
75c86ef90a
Mathieu Arnold (mat) · 2.3.0 · as textproc/py-elasticsearch-py
Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight
597afc47ba
Jimmy Olgeni (olgeni) · 2.3.0 · as textproc/py-elasticsearch-py
Update textproc/py-elasticsearch-py to version 2.3.0.

PR:		208395
Submitted by:	olgeni
Approved by:	maintainer
0d2f254ce9
Jimmy Olgeni (olgeni) · 1.8.0 · as textproc/py-elasticsearch-py
Upgrade textproc/py-elasticsearch-py to 1.8.0.

PR:		203756
Submitted by:	olgeni
Approved by:	maintainer
1eb31cc188
Jimmy Olgeni (olgeni) · 1.7.0 · as textproc/py-elasticsearch-py
Upgrade textproc/py-elasticsearch-py to 1.7.0.

PR:		203254
Submitted by:	olgeni
Approved by:	maintainer
1acc380e85
Mathieu Arnold (mat) · 1.3.0 · as textproc/py-elasticsearch-py
Update ports in the remaining categories to not use GH_COMMIT.

With minor cleanups to make things simpler.

With hat:	portmgr
Sponsored by:	Absolight
fb4deed873
Ryan Steinmetz (zi) · 1.0.0 · as textproc/py-elasticsearch-py
New port: textproc/py-elasticsearch-py:

Official low-level client for Elasticsearch. It's goal is to provide common
ground for all Elasticsearch-related code in Python; because of this it tries
to be opinion-free and very extendable.

WWW: http://elasticsearch-py.readthedocs.org/en/master/
e593f550ec