AFL++

AFL++ is a free coverage-guided fuzzer for exploring new execution paths in target programs. It mutates input and checks whether the target binary reaches a path that has not been seen before. Its afl-cc compiler supports LTO, LLVM, and GCC_PLUGIN instrumentation modes. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel, and redqueen. Documentation covers programs with available source, binary-only targets, network services, and GUI programs; builds can focus on source-only fuzzing, binary-only fuzzing, or both. A Docker image is available for x86_64 and arm64, with an example that mounts target source at /src. For Linux, installation guidance recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build instructions cover x86_64 and arm64, though afl-clang-lto, afl-gcc-fast, and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and generate heavy filesystem activity. The combined afl-fuzz program is AGPL-licensed; modified network services must offer users the corresponding source. A commercial license is listed at €20,000 a year.

AFL++ provides input mutation and coverage guidance across several target types and build setups. Review its AGPL obligations, platform caveats, and resource demands before deploying it.

AFL++ suits developers and security teams working with supported target types who need coverage-guided fuzzing. Its license terms are also relevant to organizations that offer modified versions as network services.

Overview

AFL++ is a coverage-guided fuzzer for developers and security teams probing software they can build or run. Its broad target support and instrumentation options are compelling, but its hardware demands and AGPL obligations call for planning before it becomes part of a workflow.

It mutates inputs and checks whether execution reaches a new path, helping teams explore behavior beyond their existing test cases. Fuzzing happens locally, so users are responsible for the machines, storage, and operating environment that runs it.

Key features

Instrumentation and mutation

The central afl-cc compiler supports LTO, LLVM, and GCC_PLUGIN instrumentation. AFL++ also offers collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel, and redqueen. That combination gives teams several ways to instrument targets and steer or vary mutations; coverage guidance and crash triage are supported as well. CI/CD support makes it a candidate for an automated development workflow, though the project’s resource warnings still matter when deciding how broadly to run it.

Target and build flexibility

Documentation covers source-available programs, binary-only targets, network services, and GUI programs. Build targets include source-only fuzzing, binary-only fuzzing, or a distribution build with both. This is useful for teams with varied target types, but breadth does not remove the work of setting up the right build and execution environment.

Containers and release channels

A Docker image supports x86_64 and arm64, with the example command mounting target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and sets LLVM 14 as the minimum. On macOS, building is documented for x86_64 and arm64, but afl-clang-lto, afl-gcc-fast, and qemu_mode do not work. The stable branch is the sensible default for teams prioritizing reliability; dev is bleeding edge and may fail to compile or contain bugs.

Pricing

The AGPL-3.0-or-later plan costs nothing and permits use, study, modification, and distribution under AGPL terms. Organizations modifying AFL++ and offering it as a network service must offer users the corresponding source. The license is a real deployment constraint, not merely a software cost consideration.

The Commercial license costs €20,000 a year, billed as a donation to EFF or CCC. It lasts one year and can be renewed by donating again; proof of donation must be emailed. It is intended for organizations that cannot or do not want to comply with AGPL. The substantial annual commitment makes this route appropriate chiefly when those terms are incompatible with the organization’s intended use.

Platforms

AFL++ lists Android, Linux, macOS, self-hosted, and Windows among its platforms. The documented compiler requirements and macOS caveats make platform labels only a starting point: teams should account for the specific instrumentation modes they need. Fuzzing can strain hardware, consume substantial memory or disk, and produce heavy filesystem I/O, so dedicated capacity may be necessary.

Who it's for

AFL++ fits developers and security teams who need mutation-based, coverage-guided fuzzing across source-built and binary targets, and who can manage local execution and licensing. Its multiple target and build paths suit mixed environments. It is a poorer fit for teams seeking a managed fuzzing service, unwilling to absorb resource-intensive runs, or unable to meet AGPL obligations and unwilling to pay for the commercial license.

Pros and cons

• Pro: Broad target coverage, including source-available programs, binary-only targets, network services, and GUI programs, helps teams address varied software.
• Pro: Multiple instrumentation and mutation options, plus crash triage and CI/CD support, can support a more integrated fuzzing workflow.
• Con: Heavy memory, disk, hardware, and filesystem demands can make sustained fuzzing costly to accommodate.
• Con: macOS does not support several documented modes, and Linux use has explicit LLVM version guidance, narrowing some setup choices.
• Con: AGPL network-service source obligations may rule out some deployments; the commercial license requires a €20,000 annual donation.

Alternatives

The alternatives below serve stream-processing needs rather than AFL++’s fuzzing purpose, so they are not direct substitutes. Confluent Cloud is a freemium option with a free Basic plan, a free trial, and managed Kafka clusters, autoscaling, and more than 80 connectors; consider it when managed stream processing, not target testing, is the goal. Esper is a free stream-processing platform with a GPL v2 plan and paid production support; it suits stream-processing needs rather than fuzzing. Materialize offers a community license for self-managed deployments capped at 24GiB memory and 48GiB disk, with chatbot and Community Slack support; choose it for self-managed stream processing. Pathway Live Data Framework has self-hosted free plans capped at 8 GB or 16 GB RAM, each with four cores; it is for live-data framework use, not fuzz testing. Apache Flink, Apache Kafka, Apache Samza, and Apache Spark are free stream-processing or data-analysis projects, and are not alternatives for fuzzing targets.

Verdict

AFL++ is a strong choice for teams that need flexible, local coverage-guided fuzzing and can accommodate its resource and licensing demands. Its instrumentation range and support for varied target types are the main reasons to choose it; look elsewhere if you need managed execution or cannot accept AGPL terms and the commercial license cost.