ClusterFuzz

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

ClusterFuzz is ranked #3 of 27 in fuzz testing software on Inferse. It runs on Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

Compared on fuzz testing software

Input generation methods: mutation, generation, hybridgoogle.github.io
Target types: binary formats, HTML, JavaScript, browser DOM, native programsgoogle.github.io
Coverage guidance: Yesgoogle.github.io
Crash triage: Yesgoogle.github.io
Execution mode: hybridgoogle.github.io
Supported languages: C, C++, Rust; potentially other LLVM-based languagesgoogle.github.io
CI/CD support: Yesgoogle.github.io

Facts

Purpose: ClusterFuzz is scalable fuzzing infrastructure that finds security and stability issues in software.google.github.io · 2 Oct 2026
Google and OSS-Fuzz: Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz.google.github.io · 2 Oct 2026
Scalability: ClusterFuzz can run on any size cluster; Google’s instance runs on 30,000 VMs.google.github.io · 2 Oct 2026
Fuzzing engines: It supports libFuzzer, AFL++, and Honggfuzz for coverage-guided fuzzing, plus blackbox fuzzing.github.com · 2 Oct 2026
Crash processing: Features include crash deduplication, testcase minimization, and regression finding through bisection.github.com · 2 Oct 2026
Bug automation: ClusterFuzz can automatically file, triage, and close bugs for issue trackers such as Monorail and Jira.github.com · 2 Oct 2026
End-to-end workflow: The infrastructure finds and triages crashes, minimizes reproducers, bisects revisions, and verifies fixes.google.github.io · 2 Oct 2026
Supported operating systems: ClusterFuzz runs on Linux, macOS, and Windows.google.github.io · 2 Oct 2026
Cloud dependencies: Production deployments use Google Cloud services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · 2 Oct 2026
Local deployment: ClusterFuzz can run locally with Google Cloud emulators, but BigQuery- and Stackdriver-dependent features are disabled and local instances are supported only on Linux and macOS.google.github.io · 2 Oct 2026
Bug tracker limit: The only bug tracker currently supported by the architecture is Chromium-hosted Monorail.google.github.io · 2 Oct 2026
Web interface: The web interface includes Testcases, Fuzzer Statistics, Crash Statistics, Upload Testcase, Jobs, and Configuration pages.google.github.io · 2 Oct 2026
Access control: Privileged users can access security bugs, upload fuzzers and corpora, and create jobs, while administrators also manage configuration and permissions.google.github.io · 2 Oct 2026
Authentication: ClusterFuzz supports various authentication providers using Firebase.github.com · 2 Oct 2026
Security reporting: The Google Security Team asks vulnerability reporters to use g.co/vulnz and says reports are processed within a day with responses within a week depending on severity.github.com · 2 Oct 2026
Support: Users can file a GitHub issue to ask questions, request features, or ask for help.github.com · 2 Oct 2026
License: The ClusterFuzz repository is published under the Apache-2.0 license.github.com · 2 Oct 2026
Crash handling: It provides crash deduplication, automatic bug filing and triage, testcase minimization, and regression finding through bisection.google.github.io · 2 Oct 2026
Fuzzing engines: It supports libFuzzer, AFL++, and Honggfuzz for coverage-guided fuzzing, as well as blackbox fuzzing.google.github.io · 2 Oct 2026
Web interface: The web interface provides access to crashes, statistics, and other information.google.github.io · 2 Oct 2026
Integrations: The overview lists Monorail and Jira as example issue trackers and Firebase for authentication; the architecture page says Monorail is currently the only supported bug tracker.google.github.io · 2 Oct 2026
Cloud requirements: Production deployments run on Google Cloud Platform and depend on services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · 2 Oct 2026
Other compute: Fuzzing bots can run on machines outside Google Compute Engine, including machines from another cloud provider, if they can access the required Google services.google.github.io · 2 Oct 2026
Local limitations: Local instances can run without Google Cloud emulators, but some features that depend on BigQuery and Stackdriver are disabled.google.github.io · 2 Oct 2026
Supported systems: ClusterFuzz runs on Linux, macOS, and Windows, while local instances are supported only on Linux and macOS.google.github.io · 2 Oct 2026
Security issues found: The project repository reports that, as of February 2023, ClusterFuzz helped identify and fix over 8,900 vulnerabilities across projects integrated with OSS-Fuzz.github.com · 2 Oct 2026