Jazzer vs OSS-Fuzz
Jazzer
github.com
OSS-Fuzz
google.github.ioSide by side
| Figure | Jazzer | OSS-Fuzz |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 2 | 1 |
| Spec score · Fuzz Testing Software | 8.6 (#4) | 7.3 (#19) |
| Purpose | Jazzer is a coverage-guided, in-process fuzzer for the JVM based on libFuzzer. | OSS-Fuzz runs fuzzers for open-source projects and privately alerts developers to bugs it detects. |
| Sanitizers | Built-in detectors cover issues including SSRF, path traversal, command injection and insecure deserialization patterns. | OSS-Fuzz runs fuzzing engines in combination with sanitizers; AddressSanitizer and UndefinedBehaviorSanitizer are the default supported sanitizers described in the setup guide. |
Plans
In their own words
Jazzer
Jazzer is a free, coverage-guided fuzzer for JVM applications, running in-process and based on libFuzzer. It supports Java, Kotlin, Scala, and Clojure targets, as well as JNI and native libraries. With JUnit 5.9.0 or newer, fuzz tests can run alongside regular unit tests. The @FuzzTest annotation lets Jazzer generate and mutate method inputs, including primitives, strings, arrays, and standard library classes. JUnit fuzz tests can use saved crashing inputs in regression mode or generate and mutate inputs to explore coverage. Built-in sanitizers detect Java security issues such as SSRF, file path traversal, and OS command injection, and provide feedback to guide fuzzing. The README documents use with Maven, Gradle, and Bazel. Jazzer can also run as a standalone binary or through its Java main class. Supported systems are Linux x86_64 and arm64, macOS 12 or newer on x86_64 and arm64, and Windows x86_64. The jazzer-junit package is available on Maven Central, and the repository identifies the project as licensed under Apache-2.0.
OSS-Fuzz
OSS-Fuzz has no write-up on Specifiction yet; its figures are above.