qdrant

v1.18.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 23d Vector Databases

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-search ai-search-engine embeddings-similarity hnsw hybrid-search image-search

+12 more

knn-algorithm machine-learning mlops nearest-neighbor-search neural-search recommender-system search search-engine search-engines similarity-search vector-db vector-search-engine

ReleasePort's take

Moderate signal

editorial:auto 13d

Qdrant v1.18.0 introduces TurboQuant, delivering 8× vector compression with no recall loss.

Why it matters: Test the new TurboQuant API in dev; migration yields up to 8‑fold storage savings without degrading search accuracy.

Summary

AI summary

TurboQuant adds 8× vector compression without recall loss.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Medium	Enforce API key/JWT authentication on internal gRPC endpoints Enforce API key/JWT authentication on internal gRPC endpoints Source: llm_adapter@2026-05-21 Confidence: high	—
Security	Medium	Bump TLS dependencies to resolve security vulnerabilities Bump TLS dependencies to resolve security vulnerabilities Source: llm_adapter@2026-05-21 Confidence: high	—
Security	Medium	Add config option to disable snapshot restore from URL Add config option to disable snapshot restore from URL Source: llm_adapter@2026-05-21 Confidence: high	—
Breaking	Medium	Fully remove RocksDB storage backend support Fully remove RocksDB storage backend support Source: llm_adapter@2026-05-21 Confidence: low	—
Feature
Feature	Medium	Add low memory mode minimize out of memory crashes Add low memory mode minimize out of memory crashes Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Add strict mode reject updates when memory usage high Add strict mode reject updates when memory usage high Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Add TurboQuant quantization variant for 8x compression Add TurboQuant quantization variant for 8x compression Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Add API to create and delete named vectors Add API to create and delete named vectors Source: llm_adapter@2026-05-21 Confidence: low	—
Performance
Performance	Medium	Reduce immutable geo index memory usage by 7x Reduce immutable geo index memory usage by 7x Source: llm_adapter@2026-05-21 Confidence: high	—
Performance	Medium	Use snapshot based shard transfers for faster recovery Use snapshot based shard transfers for faster recovery Source: llm_adapter@2026-05-21 Confidence: high	—
Performance	Medium	Release shard holder lock during search preventing blocks Release shard holder lock during search preventing blocks Source: llm_adapter@2026-05-21 Confidence: high	—
Performance	Medium	Use dynamic CPU pool for search workers improving performance Use dynamic CPU pool for search workers improving performance Source: llm_adapter@2026-05-21 Confidence: high	—
Performance	Medium	Use operation size based batching in shard transfers Use operation size based batching in shard transfers Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix
Bugfix	Medium	Fix cluster state corruption on crash during resharding Fix cluster state corruption on crash during resharding Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix missing shard errors after resharding down operations Fix missing shard errors after resharding down operations Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix Raft consensus correctness bugs Fix Raft consensus correctness bugs Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix infinite loop in HNSW subgraph building Fix infinite loop in HNSW subgraph building Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix panic on corrupt collection alias file return error Fix panic on corrupt collection alias file return error Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix data race in disk watcher causing timeouts Fix data race in disk watcher causing timeouts Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix panic when multiple validation errors occur Fix panic when multiple validation errors occur Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix panic on non-UTF-8 characters in snapshot path Fix panic on non-UTF-8 characters in snapshot path Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix GPU not being used for HNSW without main graph Fix GPU not being used for HNSW without main graph Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Clear shard data on snapshot transfer prevent disk crash Clear shard data on snapshot transfer prevent disk crash Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix phrase matching crossing string-array element boundaries Fix phrase matching crossing string-array element boundaries Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix nested MatchTextAny not using full-text index Fix nested MatchTextAny not using full-text index Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix snapshot files not cleaned up on restore failure Fix snapshot files not cleaned up on restore failure Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix map index listing modified file as immutable Fix map index listing modified file as immutable Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix IsEmpty condition on freshly rebuilt null index Fix IsEmpty condition on freshly rebuilt null index Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix unreliable page cache clearing with missing candidates Fix unreliable page cache clearing with missing candidates Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fix panic in sparse vector search score post processing Fix panic in sparse vector search score post processing Source: llm_adapter@2026-05-21 Confidence: low	—

Full changelog

Change log

Features 🏎️

milestone!48 - Add TurboQuant quantization variant, 8x vector compression without the recall tax
https://github.com/qdrant/qdrant/pull/8605 - Add API to create and delete named vectors in existing collection
https://github.com/qdrant/qdrant/pull/8606 - Deep memory reporting, show memory usage breakdown for storage components
https://github.com/qdrant/qdrant/pull/8714 - Add low memory mode, force open everything on disk to minimize out of memory crash on startup
https://github.com/qdrant/qdrant/pull/8715 - Add strict mode parameter to reject updates when memory usage is high (max_resident_memory_percent)

Improvements 📏

https://github.com/qdrant/qdrant/pull/8790, https://github.com/qdrant/qdrant/pull/8769 - Use dynamic CPU pool for search workers, improve search performance when there's high IO wait
https://github.com/qdrant/qdrant/pull/8526, https://github.com/qdrant/qdrant/pull/8656 - Use operation size based batching in shard transfers to achieve higher throughput
https://github.com/qdrant/qdrant/pull/8673 - Reduce memory usage of immutable geo index by 7x
https://github.com/qdrant/qdrant/pull/8529 - Fully remove RocksDB support, simplifying storage handling
https://github.com/qdrant/qdrant/pull/8768 - Don't stall update queue when waiting for deferred points
https://github.com/qdrant/qdrant/pull/8944 - Use default timeout of 60 seconds to update requests, clean up long running update requests
https://github.com/qdrant/qdrant/pull/8767 - When collection update triggers optimizer recreation, clear any optimizer errors to allow recovery without restart
https://github.com/qdrant/qdrant/pull/8784 - Use snapshot based shard transfers for much faster recovery if WAL delta cannot be resolved
https://github.com/qdrant/qdrant/pull/8782 - On snapshot transfer, first clear shard data on receiver to prevent out of disk crash
https://github.com/qdrant/qdrant/pull/8689 - Clean temporary directories before loading collections, may prevent out of disk crash on recovery
https://github.com/qdrant/qdrant/pull/8830 - Don't hold shard holder lock during search to prevent blocking various other operations
https://github.com/qdrant/qdrant/pull/8626, https://github.com/qdrant/qdrant/pull/8635 - Record API method path in audit log events
https://github.com/qdrant/qdrant/pull/8402 - Report tracing ID in audit log events
https://github.com/qdrant/qdrant/pull/8636 - Report audit log configuration and data size in telemetry and metrics
https://github.com/qdrant/qdrant/pull/8640 - Optimize cosine normalization on ARM CPUs (SIMD)
https://github.com/qdrant/qdrant/pull/8571 - Skip audit logging on telemetry endpoints
https://github.com/qdrant/qdrant/pull/8693 - Make HNSW sub graph building deterministic
https://github.com/qdrant/qdrant/pull/8712, https://github.com/qdrant/qdrant/pull/8708, https://github.com/qdrant/qdrant/pull/8706 - Report various structures in deterministic order
https://github.com/qdrant/qdrant/pull/8932 - Link to agentic skills in startup message

Bug Fixes 🪺

https://github.com/qdrant/qdrant/pull/8728 - Fix stop words always being lowercased over gRPC even if disabled
https://github.com/qdrant/qdrant/pull/8719 - Fix datetime parsing for YYYY-MM-DDTHH:MM format
https://github.com/qdrant/qdrant/pull/8734 - Fix IsEmpty condition on freshly rebuilt null index
https://github.com/qdrant/qdrant/pull/8939 - Fix nested MatchTextAny not using full-text index
https://github.com/qdrant/qdrant/pull/8646 - Fix geo circle hash bound checks
https://github.com/qdrant/qdrant/pull/8938 - Fix phrase matching crossing string-array element boundaries
https://github.com/qdrant/qdrant/pull/8762 - Fix hard panic when there are multiple validation errors
https://github.com/qdrant/qdrant/pull/8194 - Disallow sparse vectors with an empty name
https://github.com/qdrant/qdrant/pull/8832 - Fix GPU not being used for HNSW without main graph
https://github.com/qdrant/qdrant/pull/8691 - Fix infinite loop in HNSW sub graph building
https://github.com/qdrant/qdrant/pull/8577 - Fix panic when snapshot path contains non-UTF-8 characters
https://github.com/qdrant/qdrant/pull/8293 - Fix hard panic on corrupt collection alias file, return error instead
https://github.com/qdrant/qdrant/pull/8574 - Fix disk IO not always being measured in map index
https://github.com/qdrant/qdrant/pull/8645 - Fix chunk capacity reservation to allocate more efficiently
https://github.com/qdrant/qdrant/pull/8651 - Fix payload index flushers absorbing cancellations as errors
https://github.com/qdrant/qdrant/pull/8474 - Fix snapshot files not cleaned up on snapshot restore failure
https://github.com/qdrant/qdrant/pull/8654 - Fix clearing page cache not being reliable, add missing candidates
https://github.com/qdrant/qdrant/pull/8542 - Fix map index listing modified file as immutable
https://github.com/qdrant/qdrant/pull/8847 - Fix data race causing disk watcher not to be woken up causing timeouts
https://github.com/qdrant/qdrant/pull/8789, https://github.com/qdrant/qdrant/pull/8917 - Make resharding operations idempotent, fix cluster state corruption on crash
https://github.com/qdrant/qdrant/pull/8831 - Fix slow request logging for read operations with shard level errors
https://github.com/qdrant/qdrant/pull/8756 - Don't allocate async search workers we don't use reducing thread count
https://github.com/qdrant/qdrant/pull/8596 - Don't write to old shards on resharding down after write hashring commit, fix missing shard errors
https://github.com/qdrant/qdrant/pull/8543 - Fix edge sparse vector search panic on score post processing
https://github.com/qdrant/qdrant/pull/8588 - Fix various Raft consensus correctness bugs upstream

Security 🕵️

https://github.com/qdrant/qdrant/pull/8676 - Enforce API key/JWT authentication on internal gRPC endpoints
https://github.com/qdrant/qdrant/pull/8628 - Add config option to disable snapshot restore from URL
https://github.com/qdrant/qdrant/pull/8619 - Bump TLS dependencies to resolve security vulnerabilities

Web UI 🍱

https://github.com/qdrant/qdrant-web-ui/pull/372 - Add memory and disk inspector, view usage breakdown per storage component
https://github.com/qdrant/qdrant-web-ui/pull/370 - Add high contrast theme
https://github.com/qdrant/qdrant-web-ui/pull/369 - Render inline documentation in collection info panel
https://github.com/qdrant/qdrant-web-ui/pull/362 - Add refresh button to some collection views
https://github.com/qdrant/qdrant-web-ui/pull/373, https://github.com/qdrant/qdrant-web-ui/pull/377 - Fix search quality latency measurement and use better naming

Breaking Changes

Fully remove RocksDB support, simplifying storage handling

Security Fixes

Bump TLS dependencies to resolve security vulnerabilities

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track qdrant

Get notified when new releases ship.

About qdrant

Qdrant - High-performance, massive-scale Vector Database and Vector Search Engine for the next generation of AI. Also available in the cloud https://cloud.qdrant.io/

All releases →