Overview

On July 22, 2026, the DuckDB team released DuckDB 1.5.5—the sixth patch release in the 1.5 (Variegata) line. While the official announcement was brief, describing it as “bugfixes and performance improvements,” the actual GitHub changelog reveals over 50 merged PRs spanning security, performance, stability, and extension updates.

Security Patches: Multiple Out-of-Bounds Read Vulnerabilities Fixed

The most significant part of this release is the multiple security fixes, addressing several out-of-bounds read vulnerabilities:

JSON Path Out-of-Bounds Read

Fixed by @jmestwa-coder in fix out-of-bounds read in json path ReadKey lookahead. When DuckDB parses complex nested JSON structures and a JSON path query exceeds the actual data boundaries, it could lead to unsafe memory access.

-- Demonstrating safe JSON path handling in 1.5.5
SELECT json_extract('{"a": {"b": 1}}', '$.a.b.c.d') AS safe_result;
-- Before 1.5.5: Could trigger undefined behavior
-- After 1.5.5: Safely returns NULL or throws a clear error

String Cast Out-of-Bounds Read

The same contributor also fixed fix out-of-bounds read in string to struct cast and fix out-of-bounds read in dictionary string decompression. These vulnerabilities could be triggered when processing specially crafted strings or dictionary-compressed data.

Additional Security Fixes

• fix out-of-bounds read on empty byte array decimals — Handling of empty byte arrays for decimal types
• backport the out-of-bounds security fixes made in #23100 — Security fixes backported from main branch

We recommend all production users upgrade to 1.5.5 immediately.

Core Performance Improvements

Parquet Processing Enhancements

DuckDB received multiple Parquet-related improvements in 1.5.5:

1. Reject inconsistent DATA_PAGE_V2: parquet: reject DATA_PAGE_V2 pages with inconsistent compressed_page_size
2. Fix false RLE corruption errors: Fix false RLE corruption error
3. Improved RLE corruption messages: Improve rle corruption error messages
4. Fix aggregate stats after row group filtering: Fix min/max aggregate stats when row groups filtered
5. Fix swapped min/max for 128-bit DECIMAL: Fix swapped min/max for multi-row-group 128-bit DECIMAL in RETURN_STATS

-- Example: Leveraging improved Parquet statistics for faster queries
CREATE TABLE parquet_stats AS
SELECT * FROM parquet_scan('s3://bucket/data/*.parquet')
WHERE date >= '2026-01-01';
-- In 1.5.5, more accurate min/max statistics enable better partition pruning

Memory Management Improvements

• Fix TemporaryMemoryManager deadlock: Fix deadlock in TemporaryMemoryManager — A critical issue that could cause database hangs under high concurrency
• Fix external hash aggregate segfault: Fix segfault in external hash aggregate when radix bits grow after going external — Large dataset sorting/grouping no longer crashes
• Fix cache eviction node memory leak: [v1.5] Fix eviction node memleak when external file write fails

# Python example: Improved memory management for large datasets
import duckdb

con = duckdb.connect(":memory:", config={
    'temp_directory': '/tmp/duckdb_temp',
    'max_memory': '8GB',
    'threads': '4'
})

# In 1.5.5, memory won't leak even if temporary writes fail
result = con.execute("""
    SELECT category, SUM(revenue) 
    FROM read_parquet('large_dataset/*.parquet')
    GROUP BY category
    ORDER BY SUM(revenue) DESC
""").fetchdf()

Feature Enhancements

Window Function Improvements

@hawkfish contributed three important window function fixes:

• Ordered FIRST_VALUE Framing: Issue #23457: Ordered FIRST_VALUE Framing
• CUME_DIST Underflow Fix: Issue #23641: CUME_DIST Underflow
• RANGE ZERO Edge Case: Issue #23664: RANGE ZERO

-- Example: Improved window function behavior
SELECT 
    date,
    revenue,
    FIRST_VALUE(revenue) OVER (
        ORDER BY date 
        RANGE BETWEEN INTERVAL '7' DAY PRECEDING AND CURRENT ROW
    ) AS week_first,
    CUME_DIST() OVER (ORDER BY revenue) AS revenue_rank
FROM sales_data;

Common Aggregate CTEs

New support for aggregate functions within Common Table Expressions: Issue #23383: Common Aggregate CTEs. This allows you to pre-aggregate data in a CTE and further manipulate it in subsequent queries.

-- Common Aggregate CTE example
WITH monthly_sales AS (
    SELECT 
        DATE_TRUNC('month', order_date) AS month,
        SUM(amount) AS total_sales,
        COUNT(*) AS order_count
    FROM orders
    GROUP BY DATE_TRUNC('month', order_date)
)
SELECT 
    month,
    total_sales,
    SUM(total_sales) OVER (ORDER BY month) AS cumulative_sales
FROM monthly_sales;

Variant Type Improvements

• Correctly get typed value stats for fully shredded variants
• Propagate lambda bindings into try operator
• Correctly promote SUGGEST_NEW to REQUIRE_NEW for variant / geometry columns

Extension Ecosystem Updates

1.5.5 simultaneously updated several core extensions:

-- HTTPFS extension improvements: Better error diagnostics
INSTALL httpfs;
LOAD httpfs;

-- Now you can see request body length and transport errors
SELECT * FROM read_json_auto('https://api.example.com/data.json');
-- Logs will show request body length and any transport errors

ADBC & CAPI Improvements

• ADBC duckdb:// URI scheme: [ADBC] Add support for duckdb:// URI scheme in URI option
• ADBC Statistics API: fix(adbc): support the ADBC Statistics API
• CAPI scalar subquery crash: Fix/capi scalar bind subquery crash
• CAPI missing statement types: Add missing statement types to capi

# ADBC duckdb:// URI scheme example
import adbc_database
import adbc_dbapi

with adbc_database.open("duckdb://my_database.db") as database:
    with adbc_dbapi.connect(database) as connection:
        with connection.cursor() as cursor:
            cursor.execute("SELECT version()")
            print(cursor.fetchone())

Concurrency & Transaction Improvements

• Fix concurrent ALTER + INSERT crash: Fix concurrent ALTER and INSERT crash — Critical fix for high-concurrency scenarios
• Fix DROP COLUMN metadata corruption: Fix DROP COLUMN corrupting per-column metadata block bookkeeping
• Dependency Manager improvements: Multiple fixes for tracking object recreation and dependency verification

-- In 1.5.5, the following concurrent operations no longer cause crashes
BEGIN;
ALTER TABLE my_table ADD COLUMN new_field VARCHAR;
INSERT INTO my_table VALUES (1, 'data');
COMMIT;

Upgrade Guide

Installing DuckDB 1.5.5

# pip install
pip install duckdb==1.5.5

# Conda install
conda install -c conda-forge duckdb=1.5.5

# CLI install
curl -L https://github.com/duckdb/duckdb/releases/download/v1.5.5/duckdb_cli-linux-amd64.zip -o duckdb.zip
unzip duckdb.zip
chmod +x duckdb

Verify Installation

import duckdb
print(duckdb.__version__)  # Should output 1.5.5

Comparison with Traditional Databases

Monetization Advice

For enterprise users and data teams, upgrading to DuckDB 1.5.5 delivers tangible business value:

1. Reduce Infrastructure Costs

With more efficient Parquet processing and memory management, identical queries can complete on fewer resources. For teams processing terabytes daily, expect 20-40% reduction in compute costs.

2. Improve Pipeline Reliability

Fixes for the concurrent ALTER + INSERT crash and TemporaryMemoryManager deadlock mean significantly lower ETL pipeline failure rates. For businesses relying on scheduled data pipelines, each pipeline failure could mean thousands of dollars in lost business value.

3. Security Compliance

Multiple out-of-bounds read fixes are crucial for organizations requiring security audit compliance. In regulated industries like finance and healthcare, unpatched security vulnerabilities can lead to compliance fines.

4. Accelerate Analytical Insights

Improved window function performance and Common Aggregate CTEs enable faster execution of complex analytical queries. Data analysts can iterate on analysis solutions more rapidly, reducing insight delivery time from hours to minutes.

5. Seamless Migration Path

For teams using PostgreSQL/MySQL for OLAP workloads, the 1.5.5 CAPI and ADBC improvements make migration smoother. Start with DuckDB as an analysis layer, then gradually migrate core workloads.

Summary

DuckDB 1.5.5, while a patch release, covers far more than just “fixing bugs.” From security patches to performance optimizations, window function improvements to concurrency enhancements, this release provides critical stability and safety upgrades for production environments.

All users running the 1.5.x series should upgrade as soon as possible.

Full changelog: GitHub Releases v1.5.5 Installation guide: DuckDB Installation