Ross ROSS = Recommend OSS · open-source software intelligence for agents

AFLplusplus/AFLplusplus

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more! observed · 2026-08-28

github.com/AFLplusplus/AFLplusplus · homepage · C · AGPL-3.0 (copyleft) observed · 2026-08-28

Health v2 · maintenance only

92/100

  • Activity 99
  • Release rhythm 78
  • Longevity 100
How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-02. Adoption (stars, forks) is never an input.

  • gap_med: 75
  • age_days: 2654
  • days_rel: 65
  • days_push: 7
  • n_releases_24m: 10

Full methodology

Adoption not part of the score

6736 stars · 1317 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

AFL++ is a superior, actively maintained fork of American Fuzzy Lop, a coverage-guided fuzzer with many mutators, power schedules, and instrumentation modes (LLVM, GCC plugin, QEMU, Unicorn, Frida). It is used to find bugs and vulnerabilities in source-available and binary-only targets.

Use cases

  • fuzz a C/C++ program to find crashes and memory bugs
  • fuzz a binary-only target without source code
  • discover security vulnerabilities in open-source libraries
  • fuzz a native Android library
  • run a coverage-guided fuzzing campaign on a file parser
  • fuzz a network service or GUI program
  • minimize a fuzzing corpus and test cases

When to choose

  • you need a fast, feature-rich coverage-guided fuzzer for C/C++ targets
  • you must fuzz binaries without source (QEMU/Unicorn/Frida modes)
  • you want the de-facto standard fuzzer used in academic fuzzing research and FuzzBench
  • you need custom mutators, power schedules, or CmpLog/Redqueen-style comparisons

When to avoid

  • you need fuzzing for managed languages like Java or Go with native tooling instead
  • you want a simple black-box fuzzer with no instrumentation setup
  • your target is a web application or API rather than a native binary
  • you cannot comply with the AGPL-3.0 license and cannot obtain the commercial license

Facets

cli-tool · maturity active

fuzzing testing security cli security penetration-testing developer-tools testing windows bsd cross-platform cli fuzzer afl coverage-guided-fuzzing qemu-mode unicorn-mode frida-mode cmplog vulnerability-discovery instrumentation linux macos android docker

6 sources

Member repositories

RepositoryRoleHealth v2
AFLplusplus/AFLplusplusmain92

For agents

markdown · JSON · MCP: product_card(name="AFLplusplus/AFLplusplus")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem