Dear Community,
Good news for our C and C++ users on SonarQube Server.
With SonarQube Server 2026.4, taint analysis for C and C++ enters beta. We introduced it on SonarQube Cloud in June, and we are now bringing the same focused security depth to Server.
Taint analysis brings deeper data-flow reasoning to your security analysis. The engine tracks untrusted data from sources (user input, external APIs) to sensitive sinks, following the flow across functions and files, so it can catch cases where the source lives in one .c/.cpp and the sink in another, which single-file analysis structurally misses.
This beta covers four high-value injection rules:
- S2076 — OS command injection (CWE-20, CWE-78).
- S2083 — Path injection / unsafe I/O path usage (CWE-20, CWE-22).
- S5145 — Logging injection (CWE-20, CWE-117).
- S5334 — Dynamic code execution injection (CWE-20, CWE-95).
These rules have already been deeply validated internally on many projects. As with any detection of this impact, we keep the beta label until it has been exposed to customers at scale and confirmed with real-world feedback.
A few things to know about the beta:
- A compilation database is required. Taint analysis is not available with Automatic Analysis or AutoConfig — it runs on projects configured with a compilation database, with or without build-wrapper.
- Expect some increase in analysis time and memory consumption. Given the importance of these rules, we believe the trade-off is justified; if needed, you can run it on a scheduled build rather than on every gated PR.
- Custom configuration of sources, sinks, sanitizers, and passthroughs is available through a taint-configuration file (Security engine custom configuration, Enterprise editions).
Availability: taint analysis beta is available in editions with C and C++ support: all SonarQube Cloud plans, and now SonarQube Server Developer Edition and above as an opt-in beta.
We look forward to your feedback.