ClusterFuzz vs Jazzer

ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided engines libFuzzer, AFL++, and Honggfuzz, alongside blackbox fuzzing. Its workflow can find crashes, group duplicates, minimize testcases, use bisection to locate regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz. The system is designed to run on clusters of any size; Google’s instance runs on 30,000 VMs. Production deployments use Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring. Local instances are supported on Linux and macOS, with some BigQuery- and Stackdriver-dependent features disabled. Although the overview mentions Monorail and Jira as examples, the architecture currently supports only Chromium-hosted Monorail. The software runs on Linux, macOS, and Windows and is licensed under Apache-2.0. Its listed price is free.

Jazzer is a free, coverage-guided fuzzer for JVM applications, running in-process and based on libFuzzer. It supports Java, Kotlin, Scala, and Clojure targets, as well as JNI and native libraries. With JUnit 5.9.0 or newer, fuzz tests can run alongside regular unit tests. The @FuzzTest annotation lets Jazzer generate and mutate method inputs, including primitives, strings, arrays, and standard library classes. JUnit fuzz tests can use saved crashing inputs in regression mode or generate and mutate inputs to explore coverage. Built-in sanitizers detect Java security issues such as SSRF, file path traversal, and OS command injection, and provide feedback to guide fuzzing. The README documents use with Maven, Gradle, and Bazel. Jazzer can also run as a standalone binary or through its Java main class. Supported systems are Linux x86_64 and arm64, macOS 12 or newer on x86_64 and arm64, and Windows x86_64. The jazzer-junit package is available on Maven Central, and the repository identifies the project as licensed under Apache-2.0.