Repolode
Submit
google

google/oss-fuzz

Google's continuous fuzzing service for open source projects, running libFuzzer, AFL++ and Honggfuzz with sanitizers to find security bugs.

View on GitHubWebsite
Stars
12,756
Forks
2,938
Open issues
840
Last commit
yesterday

What is it?

OSS-Fuzz is a continuous fuzz testing service that Google runs for open source projects. Fuzzing feeds programs large volumes of unexpected inputs to surface crashes and memory errors such as buffer overflows, which can carry security implications.

The project supports the libFuzzer, AFL++ and Honggfuzz engines combined with sanitizers, and uses ClusterFuzz as a distributed execution and reporting backend. Supported languages include C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua, with x86_64 and i386 builds.

Projects that cannot use the hosted OSS-Fuzz service, such as closed-source code, can run their own ClusterFuzz or ClusterFuzzLite instances.

Key features

  • 01Runs libFuzzer, AFL++ and Honggfuzz engines alongside sanitizers.
  • 02Distributed fuzzing execution and bug reporting via ClusterFuzz.
  • 03Supports C/C++, Rust, Go, Python, Java, JavaScript and Lua targets.
  • 04Self-hostable through ClusterFuzzLite for projects outside the hosted service.

Use cases

  • Continuously fuzzing a widely used open source C or C++ library to catch memory safety bugs.
  • Adding fuzz targets to a Go, Rust or Python project to find crashes before release.
  • Running self-hosted fuzzing for a private codebase that cannot use the public service.

Quick start

  1. 1

    Read the detailed documentation to learn how to onboard a project

Things to know

  • OSS-Fuzz is a service for qualifying open source projects, so closed-source projects must self-host ClusterFuzz or ClusterFuzzLite instead.
  • It is a fuzzing infrastructure project rather than a standalone tool, so it is not something you run locally out of the box.

Topics

#fuzz-testing#security#vulnerability-detection#libfuzzer#sanitizers#ci#fuzzing#oss-fuzz#stability#vulnerabilities

FAQ

What is oss-fuzz?
Google's continuous fuzzing service for open source projects, running libFuzzer, AFL++ and Honggfuzz with sanitizers to find security bugs. OSS-Fuzz is a continuous fuzz testing service that Google runs for open source projects. Fuzzing feeds programs large volumes of unexpected inputs to surface crashes and memory errors such as buffer overflows, which can carry security implications.
Is oss-fuzz free to use? What license does it have?
oss-fuzz is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is oss-fuzz still maintained?
Actively maintained. The last commit to oss-fuzz was on Oct 19, 2026.
What can I use oss-fuzz for?
Continuously fuzzing a widely used open source C or C++ library to catch memory safety bugs. Adding fuzz targets to a Go, Rust or Python project to find crashes before release. Running self-hosted fuzzing for a private codebase that cannot use the public service.
How do I install oss-fuzz?
Read the detailed documentation to learn how to onboard a project
Where can I get oss-fuzz?
The source code and installation instructions are on GitHub: https://github.com/google/oss-fuzz

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects