OSS-Fuzz

Spec sheet

Purpose

OSS-Fuzz runs fuzzers for open-source projects and privately alerts developers to bugs it detects.Read 30 Sep 2026 · google.github.io

Founded

2016Read 23 Sep 2026 · google.github.io

Access requirement

Project contacts need a Google account for full access to ClusterFuzz, including crash reports and fuzzer statistics.Read 30 Sep 2026 · google.github.io

Alternative deployment

Projects that do not qualify for OSS-Fuzz, including closed-source projects, can run their own ClusterFuzz or ClusterFuzzLite instances.Read 30 Sep 2026 · google.github.io

Architectures

OSS-Fuzz supports fuzzing x86_64 and i386 builds, with i386 not enabled by default.Read 30 Sep 2026 · google.github.io

Build limit

The setup guide says OSS-Fuzz allows up to four builds per day and builds once per day by default.Read 30 Sep 2026 · google.github.io

Build setup

Projects provide a Dockerfile and build.sh script to define the build environment and produce fuzz targets.Read 30 Sep 2026 · google.github.io

Eligibility

A project seeking acceptance must be open source and have a significant user base and/or be critical to global IT infrastructure.Read 30 Sep 2026 · google.github.io

Fuzzing engines

The documentation lists libFuzzer, AFL++, Honggfuzz and Centipede, with Centipede identified as experimental in the FAQ.Read 30 Sep 2026 · google.github.io

Issue reporting

By default, issues are filed in the OSS-Fuzz tracker; projects can opt to mirror them on GitHub.Read 30 Sep 2026 · google.github.io

Languages

The site lists C/C++, Rust, Go, Python, Java/JVM, JavaScript and Lua as supported languages.Read 30 Sep 2026 · google.github.io

Maker history and location

Google says it was officially born in August 1998 and that its current headquarters, the Googleplex, is in Mountain View, California.Read 30 Sep 2026 · about.google

Resource limit

The guide states that builders have 250 GB of disk space, including the operating system, and builds must stay below that peak usage.Read 30 Sep 2026 · google.github.io

Sanitizers

OSS-Fuzz runs fuzzing engines in combination with sanitizers; AddressSanitizer and UndefinedBehaviorSanitizer are the default supported sanitizers described in the setup guide.Read 30 Sep 2026 · google.github.io

Testing approach

It combines modern fuzzing techniques with scalable, distributed execution to improve open-source software security and stability.Read 30 Sep 2026 · google.github.io

Plans and prices

Every OSS-Fuzz plan and price →

Where Specifiction places it

• Fuzz Testing Software#19 of 267.3