Apache Doris

Latest releases: 4.1.3 (July 2026) on the "Latest" feature branch; 4.0.6 (June 2026) on the "Stable" branch. Doris ships two parallel lines — Stable (continuous bug fixes, the production recommendation; currently 4.0.6) and Latest (newest features for evaluation; currently 4.1.3). Production deployments should track the 4.0 Stable line; the 4.1 features below are on the Latest line. Per Apache Doris version rules and all releases.

CVE-2026-58319 — FE HTTP API authentication bypass, patched in 4.1.3 (July 2026). An authentication-bypass vulnerability in the Doris frontend HTTP API makes 4.1.3 a security upgrade, not a routine patch — internet-reachable FE endpoints on earlier 4.1.x should upgrade immediately. Reported via security-tracker coverage; verify against the official Apache advisory before citing severity numbers. Per CVE-2026-58319 tracker writeup.

Apache Doris 4.1.0 (April 21, 2026) — unified storage and retrieval for AI + search. Doris 4.1 extends the AI/agent foundation from 4.0 with two new vector index types — IVF and IVF_ON_DISK — that scale vector retrieval to billion- and trillion-vector datasets. The search() function now supports BM25 scoring with Elasticsearch-compatible syntax, so full-text search and analytics share one SQL surface. Native support for single JSON documents up to 100 MB targets agent memory and long-context AI workloads. On the OLAP side: +22.6% on TPC-H, +19.1% on TPC-DS, +14.3% on SSB vs 4.0, and ranks first on ClickBench cold-query.

Lakehouse parity — full Iceberg V2/V3 read+write, Paimon DDL via SQL. Per the velodb deep-dive on 4.1, Doris 4.1 supports full Apache Iceberg V2 and V3 read and write (including the v3 deletion-vector path), Apache Paimon DDL management directly via SQL, and a +20% Parquet Page Cache uplift on cold reads. Combined with vector + full-text + structured filtering in one engine, this positions Doris as a single-system replacement for "OLTP + analytics + AI" stacks that previously required two or three engines.

Doris 34x faster than ClickHouse on real-time updates (vendor benchmark). A vendor-published benchmark measured Doris up to 34× faster than ClickHouse on real-time update workloads — the workload pattern where ClickHouse historically struggles (heavy concurrent UPSERT). The headline number comes from a vendor source so weight accordingly, but it reinforces a structural difference: Doris was designed primary-key-first, ClickHouse mutation-second.

70% better price-performance on AWS Graviton4 (ARM). Independent benchmark on AWS Graviton4 across five OLAP suites (ClickBench, SSB 100G, SSB-Flat, TPC-H, TPC-DS) shows Doris on ARM-based Graviton consistently delivers 54–70% higher price-performance vs equivalent x86 instances, attributed to vectorized CPU instruction usage and ARM Neoverse N3 multithreading. The architectural takeaway: Doris is one of the OLAP engines that meaningfully compounds the cloud-ARM cost shift, not just runs on it.

Doris 4.1 wins ASOF JOIN across all 11 scenarios vs ClickHouse + DuckDB (June 11, 2026). A vendor-published benchmark reports Doris 4.1 outperforming both ClickHouse and DuckDB on every one of 11 ASOF-JOIN scenarios — the time-series "as-of" join that's central to financial, IoT, and observability workloads and historically a DuckDB/ClickHouse strength. Vendor-sourced, so weight the magnitude accordingly, but the clean sweep is notable: ASOF was a gap in Doris's story a year ago, and closing it on Parquet/Iceberg-on-S3 data is what makes Doris a credible single-engine answer for time-series and OLAP and AI retrieval. This is the sharpest data point in the mid-2026 query-engine convergence (everyone standardizing on Arrow + Parquet + S3).

Cross-Cluster Replication (CCR) performance numbers, published for the first time in this profile. On a TPC-H 1T dataset (FE 2c16g, 3× BE 16c64g/500GB), full sync completes in 6m1s, incremental sync in 33s, and Flink-fed real-time sync of 100M rows holds lag ≤5s at every stage. Per Apache Doris — CCR Performance Benchmarks.

Vector search benchmark numbers back up the 4.1 ANN story with concrete recall/QPS figures. Single-node (16c64g): 481 QPS at 92% recall on a 768-dim/10M-vector set, 414 QPS at 96.7% recall on 1536-dim/5M; distributed 3×16c64g scales to 100M vectors at 77 QPS/92.9% recall with PQ quantization. Per Apache Doris — Large-scale Performance Benchmark.

A rare non-Doris-favorable comparison flags write-heavy and point-query workloads as a weak spot. A StarRocks-vs-Doris write-up puts StarRocks ahead on real-time order updates (99.9% stable throughput vs Doris hitting "frequent version conflicts") and point-query latency (<50ms vs 80-120ms), while Doris keeps the edge on complex multi-table joins. Tertiary, single-source (CSDN blog) — a useful counterweight to the vendor benchmarks already dominating this profile, but treat as informed opinion, not verified. Per StarRocks 与 Apache Doris 深度对比.

The official 2026 roadmap re-centers Doris on AI-native data infrastructure — "Scale Intelligence, Accelerate Insight." The project's public roadmap names four directions for the year: semi-structured data (VARIANT type, sparse columns), hybrid retrieval that fuses vector, full-text, and structured analytics in a single SQL statement, open lakehouse read/write with Iceberg V3 and Apache Paimon under unified governance, and core-engine work on incremental computation, storage efficiency, and query performance. The explicit framing: data usage is expanding from serving people to serving agents. Per Doris Roadmap 2026 (apache/doris #60036). Sources: Apache Doris all releases (doris.apache.org) · Apache Doris blog (ASOF JOIN benchmark, June 2026) · Apache Doris 4.1: Unified Storage and Retrieval (velodb.io) · Apache Doris 34x faster than ClickHouse on real-time updates (doris.apache.org) · Apache Doris 70% better price-performance on AWS Graviton (velodb.io)