ByteZone
Back to listClaim this project

googleSecurity & privacy

clusterfuzz

A scalable fuzzing infrastructure developed by Google for automating the discovery of security vulnerabilities and stability issues in software.

  • Security
  • QA / Testing
  • DevOps
  • Automation
  • Testing
  • Web
  • Linux
  • Self-hostable
  • Docker supported
Open websiteView on GitHub
clusterfuzz screenshot
Popularity
5.6k Stars
GitHub stars
Recent activity
8/21/2026
Updated in the last 30 days
License
APACHE-2.0
Permissive

Why it matters

We look beyond stars: what problem it solves, whether it creates real utility, and what makes its approach worth noticing.

Last 90 days

Problem

Identifying security vulnerabilities and stability defects in large-scale software projects is complex and time-consuming.

Practical value

Provides end-to-end management capabilities including distributed test execution across engines, crash deduplication, automated bug filing, and regression bisection.

Innovation / differentiation

Scales to tens of thousands of virtual machines while integrating precise crash deduplication and multi-engine orchestration.

Leverage potential

Widely adopted by Google and OSS-Fuzz, supporting security testing pipelines for numerous open-source and proprietary projects.

Why now

Operating as a mature, long-standing infrastructure project that continues to secure software ecosystems.

Community activity

In the last 90 days there were 6 new issues and 130 pull requests; the bounded issue/PR samples include 6 issue authors and 27 PR contributors, with at least 28 releases.

Maintainer responsiveness

The 6-issue window sample had a 33% close rate, and the 100-pull-request sample had a 62% merge rate. Maintainer-comment observations covered only 33% of that issue sample, so response rate and first-response speed are not reported.

27 contributors in PR sampleAt least 28 releasesPR merge rate 62% · 100 sampled in window

Key highlights

  • Supports multiple coverage-guided fuzzing engines like libFuzzer and AFL
  • Automated crash deduplication and issue tracker integration
  • Testcase minimization and bisection for regression analysis

Quick start

How it is installed, how hard it is, and where to start.

Where it runs

Self-hosted (your own server)

Difficulty

Harder — CLI / server skills help

Docker supportedSelf-hostable
  1. 01Consult the official documentation for deployment instructions.
  2. 02Configure the cluster environment and set up the fuzzing engines.

Best for

  • Teams that want data on their own servers
  • People who prefer Docker deploys

More about it

ClusterFuzz is a fuzzing infrastructure designed to identify security and stability issues in software. By leveraging distributed clusters to run multiple fuzzing engines, it handles large-scale testing workloads and automates the entire lifecycle from crash detection and deduplication to automated bug filing.

The system supports both coverage-guided and blackbox fuzzing. It integrates with issue trackers like Jira or Monorail to help developers efficiently manage the vulnerability remediation lifecycle.

Sources

Each field shows its status and source — expand to review.

15 · Expand

  • capability tags

    Verified

    automation, testing, security

    Source: admin_cms · cms editor · 8/22/2026

  • editor note

    Verified

    {"en":"This project serves as the core fuzzing engine for Google and OSS-Fuzz, suitable for security teams requiring large-scale distributed testing. For lightweight CI/CD integration, consider its sibling project, ClusterFuzzLite.","zh":"该项目是 Google 内部及 OSS-Fuzz 的核心模糊测试引擎，适合需要大规模分布式测试能力的专业安全团队。对于轻量级 CI/CD 集成需求，建议参考其姊妹项目 ClusterFuzzLite。"}

    Source: admin_cms · cms editor · 8/22/2026

  • how to use

    Verified

    {"steps":[{"en":"Consult the official documentation for deployment instructions.","zh":"查阅官方文档以获取部署指南。"},{"en":"Configure the cluster environment and set up the fuzzing engines.","zh":"配置集群环境并设置模糊测试引擎。"}],"installAt":"self_host","difficulty":"hard"}

    Source: admin_cms · cms editor · 8/22/2026

  • intro

    Verified

    {"en":"ClusterFuzz is a fuzzing infrastructure designed to identify security and stability issues in software. By leveraging distributed clusters to run multiple fuzzing engines, it handles large-scale testing workloads and automates the entire lifecycle from crash detection and deduplication to automated bug filing.\n\nThe system supports both coverage-guided and blackbox fuzzing. It integrates with issue trackers like Jira or Monorail to help developers efficiently manage the vulnerability remediation lifecycle.","zh":"ClusterFuzz 是一个用于发现软件安全与稳定性问题的模糊测试基础设施。它通过分布式集群运行多种测试引擎，能够处理大规模的测试负载，并提供从崩溃检测、去重到自动提交 Bug 的全流程自动化能力。\n\n该系统不仅支持覆盖率引导的模糊测试，还支持黑盒测试模式。它通过与 Jira 或 Monorail 等问题追踪系统集成，帮助开发人员高效管理漏洞修复生命周期。"}

    Source: admin_cms · cms editor · 8/22/2026

  • Latest release

    Verified

    v2.37.1

    Source: GitHub API · latest_release=v2.37.1 · 8/22/2026

  • License

    Verified

    Apache-2.0

    Source: GitHub API · license.spdx_id=Apache-2.0 · 8/22/2026

  • needs api key

    Verified

    No

    Source: admin_cms · cms editor · 8/22/2026

  • One-liner

    Verified

    {"en":"A scalable fuzzing infrastructure developed by Google for automating the discovery of security vulnerabilities and stability issues in software.","zh":"Google 开发的可扩展模糊测试基础设施，用于自动化发现软件中的安全漏洞与稳定性问题。"}

    Source: admin_cms · cms editor · 8/22/2026

  • Platforms

    Verified

    linux

    Source: admin_cms · cms editor · 8/22/2026

  • Category hint

    Inferred from materials

    security

    Source: Project README · hint=security · 8/14/2026

  • product forms

    Verified

    web

    Source: admin_cms · cms editor · 8/22/2026

  • role tags

    Verified

    security, qa, devops

    Source: admin_cms · cms editor · 8/22/2026

  • supports docker

    Verified

    Yes

    Source: Repository file · dockerfile=true; compose=false · 8/22/2026

  • supports local

    Verified

    No

    Source: admin_cms · cms editor · 8/22/2026

  • supports self host

    Verified

    Yes

    Source: admin_cms · cms editor · 8/22/2026

Related projects

Other verified projects matched by category, capabilities, and intended roles.

openbao

An open-source secrets management system for storing, distributing, rotating, and controlling access to secrets, certificates, and keys.

Same Security & privacy categoryBoth support Automation

agent-governance-toolkit

A governance toolkit for AI agents that adds policy checks, identity, audit trails, sandboxing, and SRE controls across multiple agent frameworks.

Same Security & privacy categoryBoth support Automation

CVE Lite CLI

A local-first JavaScript/TypeScript lockfile vulnerability scanner focused on actionable remediation, with CI, SARIF, HTML reports, and offline advisory data.

Same Security & privacy categoryBoth support Testing

prismor

A self-hosted runtime security control plane for AI coding agents, providing real-time monitoring, blocking, and human-in-the-loop approval for tool calls.

Same Security & privacy categoryBoth support Automation

fleet

A device-management platform for IT and security teams covering MDM, software deployment, patching, inventory queries, and compliance across desktop and mobile operating systems.

Same Security & privacy categoryBoth support Automation

syzkaller

An unsupervised, coverage-guided kernel fuzzer that supports multiple operating systems.

Same Security & privacy categoryBoth support Testing