qdrant

v1.18.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d Vector Databases

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-search ai-search-engine embeddings-similarity hnsw hybrid-search image-search

+12 more

knn-algorithm machine-learning mlops nearest-neighbor-search neural-search recommender-system search search-engine search-engines similarity-search vector-db vector-search-engine

Affected surfaces

auth

ReleasePort's take

Light signal

editorial:auto 12d

Qdrant v1.18.1 introduces io_uring support for quantized multi‑vector scorers and adds authorization checks before snapshot file uploads.

Why it matters: Io_uring enables higher I/O throughput for quantized scoring; mandatory auth on snapshot uploads prevents unauthorized data ingestion.

Summary

AI summary

Updates https, Bug Fixes, and Change log across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Authorize request before accepting snapshot file upload. Authorize request before accepting snapshot file upload. Source: llm_adapter@2026-05-22 Confidence: low	—
Feature	Medium	Validate vector dimensions before WAL write for async upserts. Validate vector dimensions before WAL write for async upserts. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Refactor quantized multi-vector scorers for io_uring support. Refactor quantized multi-vector scorers for io_uring support. Source: llm_adapter@2026-05-22 Confidence: low	—
Performance	Medium	Do not use unnecessary sequential mmaps. Do not use unnecessary sequential mmaps. Source: llm_adapter@2026-05-22 Confidence: high	—
Performance	Medium	Recreate workers/optimizers async to not block consensus. Recreate workers/optimizers async to not block consensus. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix
Bugfix	Medium	Notify pending consensus ops on snapshot apply. Notify pending consensus ops on snapshot apply. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix indexed integer range filter with float values. Fix indexed integer range filter with float values. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix `{match: {except: []}}` returning zero results with payload index. Fix `{match: {except: []}}` returning zero results with payload index. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix resharding cleanup data race with update queue. Fix resharding cleanup data race with update queue. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Restart optimizer on conflicting vector schema. Restart optimizer on conflicting vector schema. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix snapshot transfer cancellation on external malformed requests. Fix snapshot transfer cancellation on external malformed requests. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix deleted mask race on optimization and snapshot creation. Fix deleted mask race on optimization and snapshot creation. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix empty vector panic. Fix empty vector panic. Source: llm_adapter@2026-05-22 Confidence: low	—
Bugfix	Medium	Fix TurboQuant heap memory under-reporting. Fix TurboQuant heap memory under-reporting. Source: llm_adapter@2026-05-22 Confidence: low	—
Bugfix	Medium	Use cluster default shard transfer method for fallback. Use cluster default shard transfer method for fallback. Source: llm_adapter@2026-05-22 Confidence: low	—
Bugfix	Medium	Do not remove shard for snapshot transfer receiver. Do not remove shard for snapshot transfer receiver. Source: llm_adapter@2026-05-22 Confidence: low	—

Full changelog

Change log

Improvements

https://github.com/qdrant/qdrant/pull/8988 - Refactor quantized multi-vector scorers for io_uring support
https://github.com/qdrant/qdrant/pull/9058 - Validate vector dimensions before WAL write for async upserts

Bug Fixes

https://github.com/qdrant/qdrant/pull/8990 - Notify pending consensus ops on snapshot apply
https://github.com/qdrant/qdrant/pull/9054 - Fix indexed integer range filter with float values
https://github.com/qdrant/qdrant/pull/9055 - Fix {match: {except: []}} returning zero results with payload index
https://github.com/qdrant/qdrant/pull/9070 - Fix empty vector panic
https://github.com/qdrant/qdrant/pull/9099 - Fix TurboQuant heap memory under-reporting
https://github.com/qdrant/qdrant/pull/9107 - Do not use unnecessary sequential mmaps
https://github.com/qdrant/qdrant/pull/9014 - Fix resharding cleanup data race with update queue
https://github.com/qdrant/qdrant/pull/9120 - Use cluster default shard transfer method for fallback
https://github.com/qdrant/qdrant/pull/9121 - Recreate workers/optimizers async to not block consensus
https://github.com/qdrant/qdrant/pull/9110 - Restart optimizer on conflicting vector schema
https://github.com/qdrant/qdrant/pull/9122 - Do not remove shard for snapshot transfer receiver
https://github.com/qdrant/qdrant/pull/9125 - Fix snapshot transfer cancellation on external malformed requests
https://github.com/qdrant/qdrant/pull/9116 - Fix deleted mask race on optimization and snapshot creation

Security

https://github.com/qdrant/qdrant/pull/9031 - Authorize request before we accept snapshot file upload

Security Fixes

Authorize request before snapshot file upload — prevents unauthorized snapshot uploads (GHSA prefix not provided)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track qdrant

Get notified when new releases ship.

About qdrant

Qdrant - High-performance, massive-scale Vector Database and Vector Search Engine for the next generation of AI. Also available in the cloud https://cloud.qdrant.io/