ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided fuzzing with libFuzzer, AFL++, and Honggfuzz, as well as blackbox fuzzing. Its workflow can find crashes, group duplicates, reduce testcases, use revision bisection to identify regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz; the project says it can run on clusters of any size. Production deployments depend on Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver. Local deployments can use emulators, but BigQuery- and Stackdriver-dependent features are disabled; local instances are supported only on Linux and macOS. The software runs on Linux, macOS, and Windows. The architecture currently supports Chromium-hosted Monorail as its bug tracker. ClusterFuzz is Apache-2.0 licensed and free.
Who it is for
It suits teams that need automated fuzzing and crash triage for software, including projects that can use the supported engines and systems. Teams should account for its Google Cloud dependencies in production and its local deployment limits.
What is good
- Supports three named coverage-guided fuzzing engines and blackbox fuzzing.
- Can minimize testcases and bisect revisions for regressions.
- Automatically files, triages, and closes bugs.
- Runs on Linux, macOS, and Windows.
- Apache-2.0 licensed and free.
What to know first
- Production deployments depend on Google Cloud services.
- Local instances are supported only on Linux and macOS.
- Only Chromium-hosted Monorail is currently supported as a bug tracker.
- Local deployments disable BigQuery- and Stackdriver-dependent features.
Verdict
ClusterFuzz covers a broad crash-finding and follow-up workflow, with options for production and local use. Its cloud requirements, local limitations, and current bug-tracker support are important constraints to weigh.
ClusterFuzz plans and pricing
All plansCompared on fuzz testing software
- Input generation methods
- mutation, generation, hybrid
- Target types
- binary formats, HTML, JavaScript, browser DOM, native programs
- Coverage guidance
- Yes
- Crash triage
- Yes
- Execution mode
- hybrid
- Supported languages
- C, C++, Rust; potentially other LLVM-based languages
- CI/CD support
- Yes
