Coverity on Polaris 2026.6.0 Release Notes

Coverity on Polaris
Version
latest
Here's what's new in Coverity on Polaris 2026.6.0.

Platform

  • Coverity 2025.6.0 and 2025.6.2 are no longer supported.
  • Support for Coverity 2025.9.0 is deprecated. It will be discontinued in a future release.
  • Coverity on Polaris supports Coverity Versions:
    • 2026.6.0 (recommended)
    • 2026.3.0
    • 2025.12.0
    • 2025.9.0 (deprecated)
  • Coverity on Polaris now supports Coverity 2026.6.0. See Coverity 2026.6.0: Supported Platforms, Languages, and Compilers. It includes the following changes:
    • Sigma 2026.3.0 updates the Linux runtime version requirement to glibc 2.28 or newer for Sigma support on Linux x86_64 and Linux ARM64.
    • Added support for Java 26.
    • Added support for Go 1.26.
    • Removed support for Go 1.24.
    • Added support for Scala 3.8 via the bundled Rapid Scan Static (Sigma) engine.
    • Added support for Visual Studio 2026 capture.
    • Removed support for FreeBSD 13.
    • Deprecation notice: macOS 14 is deprecated as of 2026.6.0 and will be removed in a future release.
    • Deprecation notice: Java 17 is deprecated as of 2026.6.0 and will be removed in a future release.
    • Important: KOTLIN CHECKER UPDATES
      • Kotlin dataflow checkers are being migrated to the bundled Rapid Scan Static (Sigma) engine in 2026.6.0.
      • Coverity on Polaris customers may see new Kotlin dataflow defects.
      • Existing Coverity dataflow defects may disappear, and triage history may be lost.
      • Those defects will be reported as new defects and will need to be re-triaged.
    • Checker Information:
      • Improved documentation and CWE mapping for the URL_MANIPULATION checker.
      • Removed interdependence between the SQLI and SQL_NOT_CONSTANT checkers to address customer false negatives.
      • Added Spring Framework modernization updates for Java analysis.
      • Coverity on Polaris 2026.6.0 includes cumulative Sigma-derived content from 2026.3.0, 2026.4.0, and 2026.4.1:
        • Added detection for hardcoded keystore and truststore passwords in Spring Integration. Sigma's existing generic secret detection continues to identify hardcoded passwords, bearer tokens, and API keys across Spring Security, Spring Boot Actuator, and various platforms including Twitch, Coinbase, OpenSea, Huawei, Hunter, and IBM.
        • New check broad_domain_attribute_cookie_core_scala_http4s_response_cookie added for Scala.
        • New check broad_domain_attribute_cookie_dotnet_core_net added for CSharp.
        • New check broad_domain_attribute_cookie_play_config added for Scala.
        • New check broad_domain_attribute_cookie_play_mvc added for Scala.
        • New check certificate_verification_disabled_crypto_ssh added for Go.
        • New check certificate_verification_disabled_crypto_tls added for Go.
        • New check cors_with_credentials_null_origin_result_play added for Scala.
        • New check csrf_protection_disabled_beego added for Go.
        • New check csrf_protection_disabled_beego_config added for Go.
        • New check excessive_session_lifetime_beego added for Go.
        • New check excessive_session_lifetime_beego_config added for Go.
        • New check excessive_session_lifetime_gin added for Go.
        • New check excessive_session_lifetime_gorilla added for Go.
        • New check hardcoded_credentials_core_kotlin added for Kotlin.
        • New check header_injection_core_kotlin added for Kotlin.
        • New check implicit_intent_core_kotlin added for Kotlin.
        • New check insecure_file_permission_core_go_os added for Go.
        • New check missing_httponly_attribute_core_scala_http4s_response_cookie added for Scala.
        • New check missing_httponly_attribute_dotnet_core_net added for CSharp.
        • New check missing_httponly_attribute_play_config added for Scala.
        • New check missing_httponly_attribute_play_mvc added for Scala.
        • New check missing_permission_check_android added for Kotlin.
        • New check missing_samesite_attribute_core_scala_http4s_response_cookie added for Scala.
        • New check missing_secure_attribute_core_scala_http4s_response_cookie added for Scala.
        • New check missing_secure_attribute_dotnet_core_net added for CSharp.
        • New check missing_secure_attribute_play_config added for Scala.
        • New check missing_secure_attribute_play_mvc added for Scala.
        • New check missing_tls_moleculer_transporter added for JavaScript, TypeScript.
        • New check missing_tls_slick_play_database_config added for Scala.
        • New check os_cmd_injection_core_kotlin added for Kotlin.
        • New check path_manipulation_core_kotlin added for Kotlin.
        • New check persistent_cookie_dotnet_core_net added for CSharp.
        • New check regex_injection_core_kotlin added for Kotlin.
        • New check root_path_attribute_cookie_core_scala_http4s_response_cookie added for Scala.
        • New check root_path_attribute_cookie_dotnet_core_net added for CSharp.
        • New check root_path_attribute_cookie_play_config added for Scala.
        • New check root_path_attribute_cookie_play_mvc added for Scala.
        • New check script_code_injection_core_kotlin added for Kotlin.
        • New check sensitive_data_leak_core_kotlin added for Kotlin.
        • New check sqli_core_kotlin added for Kotlin.
        • New check unencrypted_sensitive_data_core_kotlin added for Kotlin.
        • New check unrestricted_access_to_file_core_kotlin added for Kotlin.
        • New check unsafe_deserialization_core_kotlin added for Kotlin.
        • New check unsafe_functionality_unsafe added for Go.
        • New check unsafe_jni_core_kotlin added for Kotlin.
        • New check url_manipulation_core_kotlin added for Kotlin.
        • New check xpath_injection_core_kotlin added for Kotlin.
        • New hardcoded secrets pattern Consumer Key (generic) added.
        • New hardcoded secrets pattern GitGuardian Personal Access Token added.
        • New hardcoded secrets pattern GitGuardian Service Account Token added.
        • New hardcoded secrets pattern GitHub Key added.
        • New hardcoded secrets pattern Github Personal Access Token added.
        • New hardcoded secrets pattern GoCardless API Key added.
        • New hardcoded secrets pattern Google API Key added.
        • New hardcoded secrets pattern Heroku OAuth Access Token added.
        • New hardcoded secrets pattern HubSpot Private App Token added.
        • New hardcoded secrets pattern Token in key added.
        • Added Perplexity API key and updated Secret key hardcoded secret patterns enabling Sigma to detect hardcoded API keys from major LLM providers including OpenAI, Anthropic, Perplexity AI, and Gemini. This enhancement significantly improves Sigma's ability to identify exposed credentials for AI services, helping teams prevent unauthorized access to their LLM accounts.
        • Modified existing Java check missing_tls_spring_boot_couchbase to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_boot_datasource to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_boot_flyway to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_boot_influx to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_boot_neo4j to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_boot_r2dbc to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_data_mongodb to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_data_r2dbc to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_datasource to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_http to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_http_client to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_http_client_reactive to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_r2dbc_connection to support Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_reactive_websocket to support Kotlin, Scala.
        • New check missing_tls_spring_boot_elasticsearch added for Java, Kotlin, Scala.
        • New check missing_tls_spring_security_oauth added for Java, Kotlin, Scala.
        • New check basic_auth_enabled_gin added for Go.
        • New check broad_domain_attribute_play_config added for Scala.
        • New check cors_no_credentials_permissive_origin_result_play_config added for Scala.
        • New check cors_with_credentials_http_origin_result_play_config added for Scala.
        • New check jwt_no_claims_validation_core_go added for Go.
        • New check missing_tls_apache_commons_io added for Java, Kotlin, Scala.
        • New check missing_tls_apache_datasource added for Java, Kotlin, Scala.
        • Modified existing Java, Scala check missing_tls_apache_http to support Kotlin.
        • New check missing_tls_core_java_sql added for Java, Kotlin.
        • New check missing_tls_jackson_core added for Java, Kotlin, Scala.
        • New check missing_tls_jackson_objectmapper added for Java, Kotlin, Scala.
        • New check missing_tls_jackson_objectreader added for Java, Kotlin, Scala.
        • Modified existing Java check missing_tls_spring_resttemplate to support Kotlin.
        • New check missing_tls_datastax_driver added for Java, Kotlin, Scala.
        • New check missing_tls_dom4j_io added for Java, Kotlin, Scala.
        • New check missing_tls_dom4j_jaxb added for Java, Kotlin, Scala.
        • New check missing_tls_guava_resources added for Java, Kotlin, Scala.
        • New check missing_tls_mongodb added for Java, Kotlin, Scala.
        • New check missing_tls_vertx added for Java, Kotlin, Scala.
        • New check sensitive_data_leak_java_grpc added for Java.
        • New check signature_verification_disabled_maven_wrapper added for Properties.
        • New hardcoded secrets pattern Generic Application Key added.
        • New hardcoded secrets pattern Spring OAuth2 Password Grant Request added.
        • New hardcoded secrets pattern Spring OAuth2 Token Introspector added.
        • New hardcoded secrets pattern Spring Security Refresh Token added.
        • New hardcoded secrets pattern Spring Security Token added.
        • Modified existing Java check certificate_verification_disabled_core_java to support Kotlin.
        • Removed the certificate_verification_disabled_android check which is duplicated by the existing certificate_verification_disabled_core_java check.
        • Modified existing Java check debug_logging_enabled_reactor_netty to support Scala.
        • Modified existing Java check file_upload_misconfiguration_of_fields_servlet to support Scala.
        • Modified existing Java check file_upload_misconfiguration_of_filesize_servlet to support Scala.
        • New check broad_filesystem_access_dropwizard_setup added for Scala.
        • New check missing_tls_java_grpc_insecure added for Java.
        • New check missing_tls_play_ws added for Scala.
        • New check missing_tls_result_play added for Scala.
        • New hardcoded secrets pattern AWS IAM Password added.
        • New hardcoded secrets pattern Basic Auth Credentials Springframework added.
        • New hardcoded secrets pattern Hardcoded IP Address added.
        • New hardcoded secrets pattern Java Security PKCS8/X509 Encoded Key added.
        • New hardcoded secrets pattern Javax Context Properties added.
        • New hardcoded secrets pattern Javax Crypto DES Key added.
        • New hardcoded secrets pattern Spring RSA Crypto Salt added.
        • New hardcoded secrets pattern Spring Security Crypto Password added.
        • New hardcoded secrets pattern Spring Security RSocket Metadata Password added.
        • New hardcoded secrets pattern Spring Security Remember me Key added.
  • Bug Fix: No known issues at this time.
  • Known issues: No known issues at this time.

CLI

  • The following versions of the Coverity on Polaris CLI Scan Client are supported in this release:
    • 2026.6.0 (recommended)
    • 2026.3.0
    • 2025.12.0
    • 2025.9.0 (deprecated)