OSS-Fuzz

Visit Website

Introduction

OSS-Fuzz provides continuous fuzzing for open-source software. Accepted projects add build scripts and fuzz targets, and Google runs them continuously on its ClusterFuzz infrastructure, reporting bugs privately to maintainers and disclosing them after fixes or deadlines.

The source code is at google/oss-fuzz on GitHub under the Apache-2.0 licence, with about 12,900 stars; the most recent commit was on 10 November 2026.

Features

1. Continuous fuzzing: Runs fuzz targets around the clock.
2. Multiple engines: libFuzzer, AFL++, honggfuzz and more.
3. Sanitizers: ASan, UBSan, MSan and others.
4. Automatic triage: Deduplication, bisection and fix verification.
5. Language support: C/C++, Rust, Go, Python, Java and more; see docs.

Pros

1. Free to use: Open source under Apache-2.0.
2. Maintained: Commits as recent as 10 November 2026.
3. Community: About 12,900 GitHub stars.

Cons

1. Open source only: For accepted open-source projects.
2. Integration work: Fuzz targets and build scripts required.

Usage and Links (Example)

Add your project by submitting a project.yaml, Dockerfile and build.sh to the OSS-Fuzz repository, then test locally:

python infra/helper.py build_fuzzers myproject
python infra/helper.py run_fuzzer myproject my_fuzzer

Resources:

• OSS-Fuzz website
• GitHub repository

Pricing

OSS-Fuzz is free for accepted open-source projects.

Recommended for?

1. Maintainers of widely used open-source projects.
2. Security-minded OSS communities.
3. Not a fit for private code.

Conclusion

OSS-Fuzz gives critical open-source projects free, continuous, large-scale fuzzing.