- Home
- Fuzz Testing Software
- ClusterFuzz
ClusterFuzz
What it is
ClusterFuzz is open-source infrastructure that uses fuzzing to find security and stability issues in software. It supports coverage-guided fuzzing with libFuzzer, AFL++, and Honggfuzz, as well as blackbox fuzzing. Its workflow can find crashes, group duplicate reports, minimize testcases, bisect revisions to locate regressions, and verify fixes. It can also automate bug filing, triage, and closure. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz; the project says it can run on clusters of any size. Production deployments depend on Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver. Local instances can use Google Cloud emulators, but features depending on BigQuery and Stackdriver are disabled, and local instances are supported only on Linux and macOS. ClusterFuzz runs on Linux, macOS, and Windows. Its repository is licensed under Apache-2.0, and the architecture currently supports Chromium-hosted Monorail as its bug tracker.
For and against
For
- Supports libFuzzer, AFL++, and Honggfuzz.
- Minimizes testcases and bisects regressions.
- Can automate bug filing and triage.
- Apache-2.0 licensed and free.
Against
- Production deployments depend on Google Cloud services.
- Local instances are supported only on Linux and macOS.
- Local BigQuery- and Stackdriver-dependent features are disabled.
- Architecture currently supports Chromium-hosted Monorail as its bug tracker.
The verdict
ClusterFuzz combines fuzzing with crash processing and bug-tracker automation, and it is available under an open-source license. Deployment requirements differ between production and local use, and local users should note the operating-system and feature limitations.
Who it suits
ClusterFuzz suits software teams that need automated fuzzing and crash triage across Linux, macOS, or Windows. Local deployment is an option for Linux and macOS users; production deployment depends on Google Cloud services.
Plans and prices
ClusterFuzz (open source)
Apache-2.0 licensed software · production deployment depends on Google Cloud services
Read 2 Oct 2026 · github.com
On the record
- Access control
- Privileged users can access security bugs, upload fuzzers and corpora, and create jobs, while administrators also manage configuration and permissions.google.github.io · read 2 Oct 2026
- Authentication
- ClusterFuzz supports various authentication providers using Firebase.github.com · read 2 Oct 2026
- Bug automation
- ClusterFuzz can automatically file, triage, and close bugs for issue trackers such as Monorail and Jira.github.com · read 2 Oct 2026
- Bug tracker limit
- The only bug tracker currently supported by the architecture is Chromium-hosted Monorail.google.github.io · read 2 Oct 2026
- Cloud dependencies
- Production deployments use Google Cloud services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · read 2 Oct 2026
- Cloud requirements
- Production deployments run on Google Cloud Platform and depend on services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · read 2 Oct 2026
- Crash handling
- It provides crash deduplication, automatic bug filing and triage, testcase minimization, and regression finding through bisection.google.github.io · read 2 Oct 2026
- Crash processing
- Features include crash deduplication, testcase minimization, and regression finding through bisection.github.com · read 2 Oct 2026
- End-to-end workflow
- The infrastructure finds and triages crashes, minimizes reproducers, bisects revisions, and verifies fixes.google.github.io · read 2 Oct 2026
- Fuzzing engines
- It supports libFuzzer, AFL++, and Honggfuzz for coverage-guided fuzzing, as well as blackbox fuzzing.google.github.io · read 2 Oct 2026
- Google and OSS-Fuzz
- Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz.google.github.io · read 2 Oct 2026
- Integrations
- The overview lists Monorail and Jira as example issue trackers and Firebase for authentication; the architecture page says Monorail is currently the only supported bug tracker.google.github.io · read 2 Oct 2026
- License
- The ClusterFuzz repository is published under the Apache-2.0 license.github.com · read 2 Oct 2026
- Local deployment
- ClusterFuzz can run locally with Google Cloud emulators, but BigQuery- and Stackdriver-dependent features are disabled and local instances are supported only on Linux and macOS.google.github.io · read 2 Oct 2026
- Local limitations
- Local instances can run without Google Cloud emulators, but some features that depend on BigQuery and Stackdriver are disabled.google.github.io · read 2 Oct 2026
- Other compute
- Fuzzing bots can run on machines outside Google Compute Engine, including machines from another cloud provider, if they can access the required Google services.google.github.io · read 2 Oct 2026
- Purpose
- ClusterFuzz is scalable fuzzing infrastructure that finds security and stability issues in software.google.github.io · read 2 Oct 2026
- Scalability
- ClusterFuzz can run on any size cluster; Google’s instance runs on 30,000 VMs.google.github.io · read 2 Oct 2026
