EVERYTHING XIAOMI
Get listed
OSS-Fuzz logo

OSS-Fuzz

OSS-Fuzz is a free service that runs fuzzers for open-source projects and privately notifies developers about detected bugs.

Place
#14 of 26
Score
6.0
OSS-Fuzz's website

What OSS-Fuzz is

OSS-Fuzz is a free service that runs fuzzers for open-source projects and privately notifies developers about detected bugs. It uses distributed execution with modern fuzzing techniques to support software security and stability. Listed engines include libFuzzer, AFL++, Honggfuzz and experimental Centipede, paired with sanitizers such as AddressSanitizer and UndefinedBehaviorSanitizer. Supported languages include C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua. Projects define their build environment and fuzz targets with a Dockerfile and build.sh script. OSS-Fuzz supports x86_64 and i386 builds, though i386 is not enabled by default. Builds run once daily by default, with up to four allowed per day, and must remain within 250 GB of builder disk space. Issues normally go to the OSS-Fuzz tracker, with an option to mirror them on GitHub. Project contacts need a Google account for full ClusterFuzz access, including crash reports and fuzzer statistics. Acceptance requires an open-source project with a significant user base and/or criticality to global IT infrastructure.

Good

  • Free service for open-source projects.
  • Supports seven listed language groups.
  • Offers multiple fuzzing engines and sanitizers.
  • Can mirror issues on GitHub.
  • Includes crash reports and fuzzer statistics through ClusterFuzz.

Watch out

  • Acceptance requires open-source eligibility and project significance.
  • Full ClusterFuzz access requires a Google account.
  • Builds are limited to four per day.
  • i386 builds are not enabled by default.

Who it suits

It suits maintainers of eligible open-source projects who want fuzzing and private bug notifications. Projects need to meet the user-base or infrastructure-importance requirement and provide the specified build setup.

Verdict

OSS-Fuzz provides a free fuzzing service for projects that meet its eligibility requirements. Its build cadence, disk limit and account requirement are important setup considerations.

Plans and prices

From OSS-Fuzz's own pricing page, checked 30 Sep 2026.

All about pricing
PlanPriceWhat it gives you
OSS-FuzzFreeFor open-source projects · acceptance requires a significant user base and/or criticality to global IT infrastructure · The official site describes it as a free service.

The facts

Each one read from OSS-Fuzz's own pages, with the date it was checked.

What it does

Access requirement
Project contacts need a Google account for full access to ClusterFuzz, including crash reports and fuzzer statistics.checked 30 Sep 2026
Alternative deployment
Projects that do not qualify for OSS-Fuzz, including closed-source projects, can run their own ClusterFuzz or ClusterFuzzLite instances.checked 30 Sep 2026
Architectures
OSS-Fuzz supports fuzzing x86_64 and i386 builds, with i386 not enabled by default.checked 30 Sep 2026
Build limit
The setup guide says OSS-Fuzz allows up to four builds per day and builds once per day by default.checked 30 Sep 2026
Build setup
Projects provide a Dockerfile and build.sh script to define the build environment and produce fuzz targets.checked 30 Sep 2026
Eligibility
A project seeking acceptance must be open source and have a significant user base and/or be critical to global IT infrastructure.checked 30 Sep 2026
Fuzzing engines
The documentation lists libFuzzer, AFL++, Honggfuzz and Centipede, with Centipede identified as experimental in the FAQ.checked 30 Sep 2026
Issue reporting
By default, issues are filed in the OSS-Fuzz tracker; projects can opt to mirror them on GitHub.checked 30 Sep 2026
Languages
The site lists C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua as supported languages.checked 30 Sep 2026
Purpose
OSS-Fuzz runs fuzzers for open-source projects and privately alerts developers to bugs it detects.checked 30 Sep 2026
Resource limit
The guide states that builders have 250 GB of disk space, including the operating system, and builds must stay below that peak usage.checked 30 Sep 2026
Sanitizers
OSS-Fuzz runs fuzzing engines in combination with sanitizers; AddressSanitizer and UndefinedBehaviorSanitizer are the default supported sanitizers described in the setup guide.checked 30 Sep 2026

The company

Founded
2016checked 23 Sep 2026
Maker history and location
Google says it was officially born in August 1998 and that its current headquarters, the Googleplex, is in Mountain View, California.checked 30 Sep 2026

Where it runs

Testing approach
It combines modern fuzzing techniques with scalable, distributed execution to improve open-source software security and stability.checked 30 Sep 2026

Alternatives to OSS-Fuzz

All alternatives
  1. 1

    Jazzer

    Free planOpen sourceAPILinuxmacOSSelf-hosted
    7.3Free plan
    Visit
  2. 2

    AFL++

    Free planAndroidLinuxmacOSSelf-hosted
    7.2From €20,000 a year
    Visit
  3. 3Mayhem logo

    Mayhem

    Free planWebAPILinuxmacOS
    7.0From $236 a month
    Visit
  4. 4ClusterFuzz logo

    ClusterFuzz

    Free planWebLinuxmacOSSelf-hosted
    6.8Free plan
    Visit
  5. 5

    cargo-fuzz

    Free planLinuxmacOSWindows
    6.7Free plan
    Visit
  6. 6

    boofuzz

    Free planAPILinuxSelf-hostedWindows
    6.4Free plan
    Visit