The newest Fuzzing resources are on the Fuzzing page. For a reading order instead of a date order, see the Fuzzing learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-08 2026 | On the Effectiveness of Mutational Grammar Fuzzing intermediate 8 min read | Technique analyzing the flaws of mutational grammar fuzzing, particularly how increased coverage doesn't always equate to more bugs and how samples tend to remain highly similar. It highlights issues found in XSLT implementations and JIT engines, suggesting potential improvements by exploring dataflow coverage or combining generative and mutational fuzzing approaches. → projectzero.google |
| 2026-06-08 2026 | Extending Ruzzy with LibAFL intermediate 7 min read | Library for extending Ruzzy, a coverage-guided fuzzer for Ruby code, with LibAFL. This integration leverages LibAFL's LLVM compatibility layer and addresses challenges like ELF `.preinit_array` section restrictions by utilizing LLVM `ld`, and resolves "No maps available; cannot fuzz!" errors by ensuring proper SanitizerCoverage initialization timing, critical for fuzzing campaigns. → blog.trailofbits.com |
| 2026-06-08 2026 | Go fuzzing was missing half the toolkit. We forked the toolchain to fix it. intermediate 5 min read | Library, gosentry, is a fork of the Go toolchain that enhances native fuzzing capabilities. It integrates LibAFL, Nautilus for grammar-based fuzzing, and capabilities for structured inputs, integer overflow detection (building on go-panikint), goroutine leak detection (via goleak), data race detection, and timeout detection. Existing Go fuzz harnesses can be used with gosentry without modification, offering improved bug detection and coverage reporting for vulnerabilities like those found in Optimism and Revm. → blog.trailofbits.com |
| 2026-05-22 2026 | Autonomous fuzzing process under LLM supervision advanced 20 min read | Library for autonomous fuzzing, codenamed fuzzlab, utilizes Large Language Models (LLMs) under strict procedural guidance to automate software security testing. This Python-based system analyzes code, generates test programs, classifies findings, and prepares reports. It has successfully identified vulnerabilities in ModSecurity and Oracle VirtualBox, demonstrating its capability to supervise fuzzing campaigns, adapt to anomalies, and improve test generation without constant human intervention, supporting various AI models through a standardized interface. → cert.pl |
| 2026-05-15 2026 | Stopping bugs before they ship: The shift to preventative security beginner | The article discusses a crucial shift in cybersecurity: moving from reactive bug fixing to proactive, preventative security measures. This approach aims to identify and resolve vulnerabilities earlier in the development lifecycle, before software is released to the public. The goal is to minimize the risk of security breaches and their associated costs, ultimately leading to more secure products and services. The emphasis is on integrating security practices throughout the entire development process, rather than treating it as an afterthought. |
| 2026-05-10 2026 | Mozilla Uses AI to Help Discover a Security Vulnerability in Firefox 271 news | Mozilla successfully employed AI to identify a security vulnerability in Firefox 271. This marks a significant step in leveraging artificial intelligence for cybersecurity, enabling more proactive discovery of potential threats. The AI's ability to analyze complex code and identify weaknesses could revolutionize vulnerability assessment and software security. This development highlights the growing importance of AI in protecting digital infrastructure and user data. |
| 2026-05-07 2026 | AI-based fuzzing targets open-source LLM vulnerabilities advanced 6 min read | Library that utilizes AI-enhanced fuzzing to discover vulnerabilities in open-source projects. This technique has already identified 26 new vulnerabilities, including a critical flaw in OpenSSL, by generating sophisticated and varied test inputs that explore new execution paths and uncover edge cases missed by traditional methods. The library aims to improve code coverage, increase efficiency, and automate vulnerability discovery, though users must be aware of potential drawbacks like false positives and the need for careful validation of AI-generated code. → reversinglabs.com |
| 2026-04-22 2026 | Jazzer: Coverage-guided, in-process fuzzing for the JVM intermediate 6 min read | Library for coverage-guided, in-process fuzzing of the JVM. Jazzer integrates with JUnit 5.9.0+ and supports Linux, macOS, and Windows platforms. It leverages libFuzzer's instrumentation for mutation-based input generation, allowing developers to write fuzz tests alongside unit tests. Jazzer can run in regression or fuzzing modes, identifying crashes and storing inputs for further analysis. It also includes built-in sanitizers to detect risky behaviors during fuzzing. |
| 2026-04-22 2026 | Fuzzing 100+ open source projects with OSS-Fuzz - lessons learned intermediate 13 min read | Writeup detailing continuous fuzzing efforts on over 100 open-source projects via OSS-Fuzz. This initiative reported 2104 bugs, including 559 security-relevant issues, with 1330 fixed. Notable findings include CVE-2020-28362 in Go-ethereum and contributions to Sudoers and Pidgin, highlighting the impact of sustained vulnerability analysis on critical software components. |
| 2026-04-22 2026 | Large Language Model guided Protocol Fuzzing (NDSS) advanced 2 min read | Tool for LLM-guided protocol fuzzing, ChatAFL leverages pre-trained large language models to extract machine-readable protocol information from natural language specifications. This engine constructs grammars for message types and mutates or predicts message sequences, significantly enhancing state and code coverage compared to state-of-the-art fuzzers like AFLNet and NSFuzz. Experiments on ProFuzzbench demonstrated ChatAFL's effectiveness in discovering previously unknown vulnerabilities in real-world protocol implementations. |
| 2026-04-22 2026 | Detect Go's silent arithmetic bugs with go-panikint intermediate 4 min read | Library for detecting silent integer arithmetic bugs in Go projects. go-panikint modifies the Go compiler to transform integer overflows and truncations into explicit panics, making them detectable by fuzzers. It successfully identified an integer overflow vulnerability in the Cosmos SDK's RPC pagination logic. The library includes mechanisms to filter intentional overflows via source location whitelisting or in-code comments. → blog.trailofbits.com |
| 2026-04-22 2026 | Denial of Fuzzing: Rust in the Windows kernel intermediate 13 min read | Library for fuzzing Windows kernel GDI components, utilizing WinAFL and WinAFL Pet for efficient testing. It details techniques for metafile fuzzing with Enhanced Metafile Format Plus (EMF+) and identifies a denial-of-fuzzing condition triggered by mutations. The library includes methodologies for memory dump analysis using Volatility and MemProcFS, and a client-server approach to capture and store mutated files for faster reproduction of kernel crashes. |
| 2026-04-22 2026 | Bringing Fuzz Testing to Kotlin with kotlinx.fuzz beginner 7 min read | Library for fuzz testing Kotlin applications. Developed by JetBrains Research, this fuzzer, named kotlinx.fuzz, leverages existing Java fuzzers like Jazzer to identify edge cases and uncover hidden vulnerabilities by automatically generating random or invalid inputs for target functions such as `Duration.parseIsoStringOrNull`. It simplifies the fuzzing process, offering improved configuration, execution, and result analysis for Kotlin projects. |
| 2026-04-22 2026 | Advanced binary fuzzing using AFL++-QEMU and libprotobuf advanced 20 min read | Tool for advanced binary-only fuzzing utilizing AFL++-QEMU, focusing on grammar-aware in-memory persistent fuzzing. This practical guide demonstrates step-by-step configuration, including instrumentation tuning for specific code paths and optimizing execution speed, using a case study of a weak X509 parser with a buffer overflow vulnerability in `parse_cert_buf`. It details corpus preparation with `afl-cmin` and `afl-tmin`, and explores AFL++-QEMU features like `AFL_CUSTOM_MUTATOR_LIBRARY` and persistent mode addresses for performance enhancements. |
| 2026-04-22 2026 | deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses advanced 50 min read | Tool integrating static analysis and LLM-guided fuzzing to detect memory safety vulnerabilities in Rust's unsafe code. deepSURF handles generics by substituting them with custom types and LLM-augmented harnesses for complex API interactions. Evaluation on 27 Rust crates revealed 20 known and 6 previously unknown memory safety bugs, surpassing state-of-the-art tools. → arxiv.org |
| 2026-04-22 2026 | Fixing Security Vulnerabilities with AI in OSS-Fuzz intermediate 41 min read | Library that customizes the AutoCodeRover LLM agent, named CodeRover-S, for autonomously fixing security vulnerabilities detected by OSS-Fuzz. This approach leverages exploit input from fuzzing campaigns to extract dynamic call graph information and augment vulnerability reports. CodeRover-S aims to improve patch generation success rates by incorporating type-based analysis at identified faulty program locations, focusing on dynamic attributes for patch correctness over static code similarity metrics. → arxiv.org |
| 2026-04-22 2026 | A Survey of Network Protocol Fuzzing: Model, Techniques and Directions intermediate 63 min read | Survey of network protocol fuzzing techniques; this paper systematically reviews advancements, proposes a unified process model, and discusses techniques for syntax acquisition, test case generation, execution, monitoring, and feedback utilization. It highlights challenges unique to network protocols, such as statefulness and structured input, and points to promising research directions, referencing vulnerabilities like Heartbleed (CVE-2014-0160) found in software like OpenSSL. → arxiv.org |
| 2026-04-19 2026 | Generative Fuzzer-Driven Vulnerability Detection in IoT Networks advanced | Generative Fuzzer-Driven Vulnerability Detection in IoT Networks |
| 2026-04-19 2026 | Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs advanced | Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs |
| 2026-04-19 2026 | Fuzz to the Future: Uncovering Occluded Future Vulnerabilities advanced | Fuzz to the Future: Uncovering Occluded Future Vulnerabilities → dl.acm.org |
| 2026-04-19 2026 | EdgeFuzz: A Middleware-Based Security Testing Tool intermediate | EdgeFuzz: A Middleware-Based Security Testing Tool |
| 2026-04-19 2026 | Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery beginner | Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery |
| 2026-04-16 2026 | Fuzzing | Testing Handbook - AppSec Guide beginner 8 min read | Handbook chapter detailing fuzzing as an essential dynamic testing method for uncovering security issues and bugs. It covers starting fuzzing projects quickly, delving into advanced techniques, and selecting appropriate fuzzers. The handbook explains how to write fuzzing harnesses, interpret their outputs, and apply them to real-world C/C++ projects, discussing both blackbox and feedback-driven graybox fuzzing approaches. It also explores mutation-based evolutionary fuzzing, the de facto algorithm, and defines key terminology such as SUT, fuzzer, harness, and corpus. → appsec.guide |
| 2026-04-16 2026 | API Fuzzing for Security Testing: Complete Guide intermediate 7 min read | Library for API fuzzing that automates vulnerability discovery by generating malformed, randomized, or boundary-case inputs to uncover weaknesses like injection attacks, authentication bypasses, and data exposure via error handling. It integrates into CI/CD pipelines, complementing static analysis and manual testing by detecting edge cases and logic flaws missed by traditional methods, significantly improving detection rates and reducing remediation costs. |
| 2026-04-16 2026 | Recent Fuzzing Papers Collection advanced | Recent Fuzzing Papers Collection |
| 2026-04-16 2026 | Awesome-Fuzzing: Curated List of Fuzzing Resources beginner 8 min read | Library collecting curated resources for learning fuzzing and exploit development, including books like "Fuzzing: Brute Force Vulnerability Discovery," courses, videos, tutorials, and vulnerable applications. It lists tools such as American Fuzzy Lop (AFL), Peach Fuzzer, honggfuzz, and Cloudfuzzer, alongside discussions of techniques like directed fuzzing and root cause analysis for vulnerabilities like integer overflows. The library also features resources on browser fuzzing frameworks like BFuzz and Grizzly. |
| 2026-04-16 2026 | KernelGPT: Enhanced Kernel Fuzzing via LLMs advanced 4 min read | Library for enhanced Linux kernel fuzzing using Large Language Models to automate Syzkaller specification generation and refinement. KernelGPT analyzes kernel source code, leverages LLMs for specification creation, and uses feedback for iterative improvement. This approach has successfully identified 24 new kernel bugs, including 11 with assigned CVEs, and many of its generated specifications have been integrated into the official Syzkaller repository. |
| 2026-04-16 2026 | ksmbd: Fuzzing Improvements and Vulnerability Discovery intermediate 9 min read | Library for improving fuzzing and discovering vulnerabilities in `ksmbd`, an SMB server implementation. This resource details techniques for expanding the attack surface by enabling configuration options like durable handles, oplocks, and SMB2 leases, and discusses fuzzer improvements. It specifically mentions patching NTLMv2 authentication, adjusting connection limits, and simulating valid SMB state transitions by parsing responses for TreeIDs and SessionIDs. The library also leverages protocol specifications to build grammars for commands like SMB2 IOCTL requests and explores fuzzing strategies such as focused area fuzzing to target specific code paths like `smb_check_perm_dacl`, which led to the discovery of integer overflows. → blog.doyensec.com |
| 2026-04-16 2026 | AFL++ Fuzzing in Depth intermediate 29 min read | Library for instrumenting and fuzzing source code targets with AFL++. This guide details the three-step process: compiling with special compilers like `afl-clang-lto` or `afl-gcc-fast`, preparing an input corpus, and executing the fuzzing process. It also covers compiler selection based on available versions (LLVM 11+, GCC 5+) and instrumentation options such as `laf-intel`, `redqueen`, and selective instrumentation via `allowlist.txt` or `denylist.txt` to optimize fuzzing efficiency. |
| 2026-04-16 2026 | The Fuzzing Book: Generating Software Tests beginner 6 min read | Library of practical examples and executable code, "The Fuzzing Book" teaches automated software testing techniques. It covers random fuzzing, mutation-based fuzzing, and grammar-based test generation, illustrated with Python code. The resource is suitable for university courses, supplementary material, or as a developer tool, and has been credited with finding over 2,600 bugs in JavaScript interpreters for browsers like Firefox, Chrome, and Edge. |
| 2026-04-16 2026 | Fuzzing101: A Step-by-Step Fuzzing Tutorial beginner 2 min read | Tutorial on fuzzing basics using AFL++ and Ubuntu 20.04 LTS. This resource features ten real-world targets and exercises to help learners discover vulnerabilities in software projects. It explains coverage-guided evolutionary fuzzing techniques, a method employed by popular fuzzers like AFL, libFuzzer, and HonggFuzz. |
| 2026-04-11 2026 | Getting Started with Python Fuzzing Using Atheris beginner 12 min read | Library for fuzz testing Python applications, Atheris, developed by Google, simplifies the process of finding bugs through coverage-guided randomized testing. It allows users to easily create fuzz harnesses for arbitrary Python code, utilizing `FuzzedDataProvider` to generate diverse input types such as strings, integers, and lists. The library integrates seamlessly with targets, reporting crashes like `ZeroDivisionError` when it encounters unexpected inputs, aiding developers in identifying and fixing edge-case vulnerabilities. |
| 2026-04-11 2026 | Unleashing Medusa: Smart Contract Fuzzing intermediate 2 min read | Library for coverage-guided, parallel, and on-chain fuzzing of EVM smart contracts. Medusa v1, built on Geth and written in Go, uses Slither insights for smart mutational value generation and provides enhanced debugging with rich execution traces. It offers an alternative to Echidna, focusing on scalability and maintainability for faster vulnerability discovery in blockchain systems. → blog.trailofbits.com |
| 2026-04-11 2026 | Mastering Boofuzz: From Basics to Advanced beginner 4 min read | Library for stateful and stateless fuzzing, Boofuzz enables robust security testing of network protocols, file formats, and embedded systems. Leveraging Python, it supports custom protocol fuzzing with checksums like CRC32 and IPv4, and allows for multi-stage fuzzing through defined states. It includes built-in crash detection, a web interface for real-time monitoring, and examples for fuzzing HTTP POST requests and authenticated FTP sessions. |
| 2026-04-11 2026 | cargo-fuzz - Testing Handbook beginner 5 min read | Tool for fuzzing Rust projects using Cargo, this handbook details setup and usage. It leverages libFuzzer and can automatically enable sanitizers like AddressSanitizer, which is useful for detecting memory errors in unsafe Rust code. The guide covers writing fuzz tests, initializing projects with `cargo fuzz init`, running fuzz targets with `cargo +nightly fuzz run`, and re-executing specific test cases. It also explores fuzzer options, including disabling sanitizers for performance boosts when not using unsafe Rust, and provides a real-world example fuzzing the `ogg` crate. → appsec.guide |
| 2026-04-11 2026 | LLM-Based Harness Synthesis for Unfuzzed Projects advanced 11 min read | Library for LLM-based fuzzing harness synthesis that automates the creation of OSS-Fuzz and ClusterFuzzLite projects for C/C++ software. It takes a GitHub repository URL as input and generates fuzzing harnesses by first building the project using generalized build heuristics, then extracting program analysis data with Fuzz Introspector, and finally synthesizing harnesses with LLMs based on that data. The process has demonstrated coverage increases and vulnerability discovery in prior work. |
| 2026-04-11 2026 | HyperHook: A Harnessing Framework for Nyx advanced 11 min read | Framework for Nyx-based fuzzers, HyperHook streamlines snapshot fuzzing for user-space applications by managing hypercalls, function hooks, and exception handlers for both Windows and Linux targets. It works by injecting a detour into the target function, initializing communication with the host, registering handlers, setting up an input buffer, and ultimately calling the target function with fuzz input. |
| 2026-04-11 2026 | Practical Jazzer for the Snazzy Fuzzer intermediate 8 min read | Library detailing practical tips for using Jazzer, a coverage-guided, in-process fuzzer for the JVM. It covers advanced techniques for enterprise Java applications, including implementing `fuzzerInitialize` and `fuzzerTearDown` methods for setup and cleanup, utilizing method hooks with reflection to inspect application state and detect vulnerabilities like context escapes, and managing timeouts with fork mode and `-ignore_timeouts`. |
| 2026-04-11 2026 | Jazzer + LibAFL: Java Fuzzing Insights intermediate 6 min read | Library for Java fuzzing, integrating LibAFL with Jazzer. This fork enhances Jazzer by replacing its LibFuzzer backend with LibAFL, incorporating custom implementations for `__sanitizer_cov_trace_cmp8_with_pc`, `__sanitizer_weak_hook_memmem`, `__sanitizer_weak_hook_strstr`, and `__sanitizer_weak_hook_compare_bytes` to improve coverage feedback and comparison analysis, addressing limitations encountered when adapting Jazzer's LibFuzzer fork to LibAFL's architecture. |
| 2026-04-11 2026 | LibAFL - Testing Handbook beginner 19 min read | Library for building custom fuzzers, LibAFL offers modular functionality beyond traditional AFL-based fuzzers and libFuzzer. It supports a libFuzzer drop-in replacement for easier integration and also serves as a core Rust library for creating highly customizable fuzzing solutions. Setup involves installing Clang and Rust, and configuring environment variables for specific LLVM versions. LibAFL enhances fuzzing performance with features like `SimpleRestartingEventManager` and `LlmpRestartingEventManager` for effective crash detection and multi-processing. → appsec.guide |
| 2026-04-11 2026 | Fuzzing Rust Using Cargo-libafl intermediate | Fuzzing Rust Using Cargo-libafl |
| 2026-04-11 2026 | LibAFL Tutorial beginner | LibAFL Tutorial |
| 2026-04-11 2026 | G2Fuzz: Grammar-Aware Fuzzing with LLMs advanced 56 min read | Library for grammar-aware fuzzing, G2Fuzz, leverages LLMs to synthesize and mutate Python scripts that generate inputs conforming to complex, non-textual grammars like TIFF images and MP4 audio. It combines LLM-driven "holistic search" for novel input generation with traditional fuzzers like AFL++ for efficient "local search." This hybrid approach significantly enhances code coverage and bug discovery, outperforming tools such as AFL++, Fuzztruction, and FormatFuzzer on benchmarks like UNIFUZZ and FuzzBench, and has discovered bugs including those acknowledged by CVEs. → arxiv.org |
| 2026-04-11 2026 | Bugs That Survive Continuous Fuzzing advanced 15 min read | Library detailing vulnerabilities that persist despite continuous fuzzing in open-source projects like Gstreamer, Poppler, and Exiv2. It highlights issues arising from insufficient code coverage, unmonitored dependencies (e.g., DjVuLibre in Poppler), and neglected encoding logic, demonstrating the ongoing need for human oversight and expertise beyond automated fuzzing initiatives like OSS-Fuzz. → github.blog |
| 2026-04-11 2026 | Fuzzing Web Apps using FFUF: Complete Guide beginner 3 min read | Library for fuzzing web applications using FFUF, covering directory discovery, subdomain enumeration, virtual host fuzzing, multi-layer extension hunting, recursive scanning, authentication testing, and API endpoint discovery. It also details workflow optimizations like rate limiting and Burp Suite integration, while warning against common pitfalls such as unauthorized testing and aggressive scanning. |
| 2026-04-11 2026 | Looking for RCE Bugs in the Linux Kernel advanced 50 min read | Library for fuzzing the Linux kernel externally over the network, extending the syzkaller fuzzer to inject network packets via TUN/TAP and collect coverage with KCOV. The article details the integration process, including adding pseudo-syscalls and handling network specifics like checksums and TCP connections, ultimately leading to the discovery of a one-shot RCE in a non-public kernel flavor. |
| 2026-04-11 2026 | Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched advanced 6 min read | Tool detailing Syzkaller's challenges with net/sched fuzzing, specifically addressing false positive soft lockups. The author's research revealed that Syzkaller's network namespace reset was insufficient, leaving residual state that triggered hangs. This led to the creation of the HangBuzz101 CTF challenge and the identification of several vulnerabilities, including CVE-2025-38001 and CVE-2025-38616, some of which were exploitable and contributed to significant bounty payouts. Modifications to the net/sched grammar in Syzlang were implemented to mitigate these false positives. |
| 2026-04-11 2026 | Writing Harnesses - Testing Handbook intermediate 8 min read | Handbook on writing fuzzing harnesses, detailing techniques beyond simple byte arrays. It demonstrates how to derive complex inputs like integers and strings from raw data, using tools such as `FuzzedDataProvider` to handle variable-length consumption and parsing. The handbook also explores interleaved fuzzing, where the initial input byte steers execution through multiple related APIs, and discusses structured fuzzing concepts for improved efficiency, including integrating with formats like protobufs. Examples cover potential vulnerabilities like division by zero and buffer overflows when manipulating input data. → appsec.guide |
| 2026-04-11 2026 | Secrets of Effective Fuzzing Harnesses intermediate 27 min read | Library on writing effective fuzzing harnesses, emphasizing harness scope, avoiding common pitfalls like data reuse and reinterpretation, and embracing best practices such as early input validation with tools like FuzzedDataProvider, output validation, state resetting, and stateless, efficient harness design for C/C++, GO, Python, and Rust. |
| 2026-04-11 2026 | Beginner's Guide to Writing a Fuzzing Harness beginner 11 min read | Library for writing fuzzing harnesses, this guide details connecting fuzzers like AFL++ and Honggfuzz to specific target functions. It covers identifying target functions, implementing resource management (e.g., `xmlFreeTextReader`), and performing validation checks on function return results. The entry emphasizes the iterative nature of fuzzing and the importance of a well-designed harness for maximizing code coverage and enabling targeted testing of complex APIs and non-standard input formats. |