What is this?
OSS-Fuzz is Google's free continuous fuzzing service for open source software: it runs guided fuzzing nonstop to surface security vulnerabilities and stability bugs before attackers do.
OSS-Fuzz is Google's free continuous fuzzing service for open source software: it runs guided fuzzing nonstop to surface security vulnerabilities and stability bugs before attackers do.Is this a tool I download, or a service Google runs?It's a service Google runs for qualifying open source projects. Projects that don't qualify (e.g. closed source) can instead run their own instances of ClusterFuzz or ClusterFuzzLite.
It's a service Google runs for qualifying open source projects. Projects that don't qualify (e.g. closed source) can instead run their own instances of ClusterFuzz or ClusterFuzzLite.How do I get my project onto it?Follow the detailed documentation, which walks you through integrating your project's build so OSS-Fuzz can fuzz it continuously.
Follow the detailed documentation, which walks you through integrating your project's build so OSS-Fuzz can fuzz it continuously.Are there hardware or architecture limits to what it can fuzz?Yes — it only supports fuzzing x86_64 and i386 builds; other architectures aren't covered.
Yes — it only supports fuzzing x86_64 and i386 builds; other architectures aren't covered.Which programming languages can it fuzz?C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua are supported out of the box, and other languages backed by LLVM may work too.
C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua are supported out of the box, and other languages backed by LLVM may work too.What fuzzing engines does it use under the hood?libFuzzer, AFL++ and Honggfuzz, combined with Sanitizers, plus ClusterFuzz — a distributed fuzzer execution environment and reporting tool.
libFuzzer, AFL++ and Honggfuzz, combined with Sanitizers, plus ClusterFuzz — a distributed fuzzer execution environment and reporting tool.Has it actually found real bugs?Yes — as of May 2025 it had helped identify and fix over 13,000 vulnerabilities and 50,000 bugs across 1,000 projects, including catching Log4Shell through its Jazzer Java fuzzer.
Yes — as of May 2025 it had helped identify and fix over 13,000 vulnerabilities and 50,000 bugs across 1,000 projects, including catching Log4Shell through its Jazzer Java fuzzer.Is it still actively developed?Yes — it launched in 2016 and the project blog runs through late 2024, with recent posts on using AI to find more vulnerabilities.
Yes — it launched in 2016 and the project blog runs through late 2024, with recent posts on using AI to find more vulnerabilities.What are similar projects?nuclei, vuls, strix, codex-guard, super-linter, wazuh, kani, sonarqube
nuclei, vuls, strix, codex-guard, super-linter, wazuh, kani, sonarqubeWhich topics is it in?vulnerabilities, vulnerability-detection, fuzzing, code-quality, ci, security-tools, shell, testing, cloud, security, automation, docker
vulnerabilities, vulnerability-detection, fuzzing, code-quality, ci, security-tools, shell, testing, cloud, security, automation, docker