Jazzer: Coverage-Guided Fuzzing for Semantic Vulnerabilities in the Java Ecosystem

Abstract

Fuzz testing has proven highly effective in uncovering software faults in low-level languages such as C and C++. Yet, memory-safe ecosystems like the Java Virtual Machine (JVM), which powers the majority of enterprise applications, have received limited attention from fuzzing research. Recent high-impact vulnerabilities such as Log4Shell and Spring4Shell highlight that memory-safe languages remain susceptible to severe security risks, including logic errors, injection vulnerabilities, and unsafe deserialization. Such vulnerability classes typically lie beyond the detection capabilities of traditional fuzzing frameworks, which are primarily designed to detect memory safety violations.

In this paper, we address this gap with Jazzer,1 a fuzzing framework specifically designed for JVM applications. Jazzer adapts proven fuzzing techniques to the JVM via bytecode instrumentation, translating Java’s high-level constructs into low-level coverage and trace feedback. To detect vulnerabilities beyond memory corruption, it complements C/C++ sanitizers with guiding oracles that hook into JVM APIs and provide guidance within sinks to uncover Java-specific vulnerabilities. Our comprehensive evaluation against JQF, the state-of-the-art Java fuzzer, shows that Jazzer achieves higher coverage and faster execution speed across eleven diverse libraries, while discovering 18 bugs missed by prior work. Finally, we
demonstrate real-world impact through large-scale deployment in OSS-Fuzz, where Jazzer has continuously fuzzed 205 open-source Java projects over a period of three years. This field study resulted in the discovery of 1217 confirmed and fixed security issues.