OSS-Fuzz is a continuous fuzzing service that automatically tests open source software to uncover security vulnerabilities and stability bugs.
The tool addresses the challenge of finding programming errors that can have serious security implications by combining modern fuzzing techniques with scalable, distributed execution. It deploys guided in-process fuzzing using multiple fuzzing engines—libFuzzer, AFL++, and Honggfuzz—in combination with sanitizers to detect memory corruption and other defects. The service runs continuously on participating projects, automatically identifying and reporting issues without requiring manual intervention from maintainers.
OSS-Fuzz is designed for open source projects that want to improve security and stability without managing their own fuzzing infrastructure. The service supports C/C++, Rust, Go, Python, Java/JVM, JavaScript, and Lua, covering a broad range of commonly used languages. Projects that cannot use the public OSS-Fuzz service—such as closed source software—can instead run their own instances using ClusterFuzz or ClusterFuzzLite. The tool integrates with the Core Infrastructure Initiative and OpenSSF to prioritize testing of widely used components in the open source ecosystem.
The project maintains active development with regular blog posts documenting improvements and new capabilities. Recent work has focused on integrating AI-powered techniques to enhance fuzzing effectiveness and expand the types of vulnerabilities detected beyond memory corruption. The tool continues to evolve its language support and fuzzing strategies to catch broader classes of bugs automatically.
