Jazzer
Coverage-guided in-process fuzzer for Java and the JVM based on libFuzzer, with built-in sanitizers for injection, path traversal, and SSRF bugs.
Technical Architecture & Overview
Jazzer is a coverage-guided, in-process fuzzing engine for the JVM, developed by Code Intelligence. It operates on JVM bytecode, so it applies to Java and other JVM-based languages, is based on libFuzzer, and is the engine OSS-Fuzz uses for continuous fuzzing of JVM open-source projects.
Targeted Technical Use Cases
Fuzzing Java and Kotlin libraries and JVM application parsers.
Evaluation & Trade-offs
Core Strengths
- +Used by OSS-Fuzz for Java and JVM project fuzzing.
- +Integrates with JUnit 5 so fuzz tests run alongside regular unit tests.
- +Detects security-relevant exceptions beyond simple crashes, including injection and deserialization bugs.
Trade-Offs & Limitations
- -Requires writing fuzz tests as JVM code, typically JUnit 5 methods annotated with @FuzzTest.
Defensive Security Application
Continuous fuzzing of JVM-based enterprise libraries to find unhandled exceptions and injection vulnerabilities.
Frequently Asked Questions
What is Jazzer?→
Jazzer is a coverage-guided, in-process fuzzing engine for the JVM, developed by Code Intelligence. It operates on JVM bytecode, so it applies to Java and other JVM-based languages, is based on libFuzzer, and is the engine OSS-Fuzz uses for continuous fuzzing of JVM open-source projects.
What is Jazzer used for?→
Fuzzing Java and Kotlin libraries and JVM application parsers.
What are the strengths of Jazzer?→
- +Used by OSS-Fuzz for Java and JVM project fuzzing.
- +Integrates with JUnit 5 so fuzz tests run alongside regular unit tests.
- +Detects security-relevant exceptions beyond simple crashes, including injection and deserialization bugs.
What are the limitations of Jazzer?→
- +Requires writing fuzz tests as JVM code, typically JUnit 5 methods annotated with @FuzzTest.
How is Jazzer used defensively?→
Continuous fuzzing of JVM-based enterprise libraries to find unhandled exceptions and injection vulnerabilities.