Jazzer
Coverage-guided in-process fuzzer for Java and the JVM based on libFuzzer, with built-in sanitizers for memory and logic bugs.
Technical Architecture & Overview
Jazzer is a coverage-guided, in-process fuzzing engine for the JVM, developed and maintained by Code Intelligence GmbH. It supports Java, Kotlin, Clojure, and other JVM languages, is based on libFuzzer, and integrates with OSS-Fuzz for continuous fuzzing of JVM open-source projects.
Targeted Technical Use Cases
Fuzzing Java/Kotlin libraries, JVM application parsers, and Android components.
Evaluation & Trade-offs
Core Strengths
- +The primary coverage-guided fuzzer for the JVM ecosystem, used in OSS-Fuzz.
- +Supports Java, Kotlin, Scala, Clojure, and other JVM languages.
- +Detects security-relevant exceptions beyond simple crashes, including injection and deserialization bugs.
Trade-Offs & Limitations
- -Requires writing fuzz targets in Java or Kotlin.
- -JVM startup overhead can slow fuzzing throughput compared to native engines.
Defensive Security Application
Continuous fuzzing of JVM-based enterprise libraries to find unhandled exceptions and injection vulnerabilities.
Frequently Asked Questions
What is Jazzer?→
Jazzer is a coverage-guided, in-process fuzzing engine for the JVM, developed and maintained by Code Intelligence GmbH. It supports Java, Kotlin, Clojure, and other JVM languages, is based on libFuzzer, and integrates with OSS-Fuzz for continuous fuzzing of JVM open-source projects.
What is Jazzer used for?→
Fuzzing Java/Kotlin libraries, JVM application parsers, and Android components.
What are the strengths of Jazzer?→
- +The primary coverage-guided fuzzer for the JVM ecosystem, used in OSS-Fuzz.
- +Supports Java, Kotlin, Scala, Clojure, and other JVM languages.
- +Detects security-relevant exceptions beyond simple crashes, including injection and deserialization bugs.
What are the limitations of Jazzer?→
- +Requires writing fuzz targets in Java or Kotlin.
- +JVM startup overhead can slow fuzzing throughput compared to native engines.
How is Jazzer used defensively?→
Continuous fuzzing of JVM-based enterprise libraries to find unhandled exceptions and injection vulnerabilities.