AFL++

Overview

AFL++ is a local, coverage-guided fuzzer for developers and security teams looking to expose paths their ordinary tests may miss. Its range of instrumentation and target types is a strong fit for teams prepared to manage the runtime environment; it is less suitable when resource use or AGPL obligations are hard constraints.

It mutates inputs and checks whether execution reaches a new path in the target binary. Documentation covers source-available programs, binary-only targets, network services, and GUI programs, with build targets for source-only fuzzing, binary-only fuzzing, or both.

Key features

Instrumentation and mutation

The central afl-cc compiler supports LTO, LLVM, and GCC_PLUGIN instrumentation. AFL++ also includes collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel, and redqueen. This breadth gives teams options for instrumentation and mutation rather than locking them into one mode. Coverage guidance, crash triage, and CI/CD support are also included.

Targets and deployment

A Docker image supports x86_64 and arm64; the example command mounts target source at /src. That offers a container-based route for local fuzzing, not a managed execution service. Fuzzing can strain hardware, consume substantial memory or disk, and generate heavy filesystem I/O, so sustained runs need an environment able to absorb those costs.

Release channels and support

The stable branch is the stability-focused default. The dev branch is bleeding edge and may fail to compile or contain bugs, making it a riskier choice for workflows that depend on predictable builds. For defects, maintainers direct users to GitHub issues, with the FAQ, best practices, and Fuzzing Zulip server as additional support resources.

Pricing

AFL++ is free to use, study, modify, and distribute under the AGPL-3.0-or-later plan at no cost. The important trade-off is licensing: modified versions offered as network services must provide users the corresponding source. The combined afl-fuzz program is AGPL as a whole. Individual source files marked Apache-2.0 may be reused under that license, while bundled third-party components retain their own licenses.

Organizations that cannot or do not want to comply with AGPL can choose the Commercial license for €20,000 a year. It lasts one year and can be renewed by donating again; the donation is billed to EFF or CCC, and proof of donation must be emailed. This is a substantial annual commitment, but it addresses the stated licensing constraint.

Platforms

AFL++ supports Linux, macOS, Windows, Android, and self-hosted use. On Linux, the installation guide recommends LLVM 18 or newer and sets LLVM 14 as the minimum. macOS builds are documented for x86_64 and arm64, but afl-clang-lto, afl-gcc-fast, and qemu_mode do not work there. That makes macOS a more limited option for workflows relying on those modes.

Who it's for

AFL++ suits teams working with C, C++, Python, or Rust targets that want local mutation-based fuzzing and can configure and provision their own execution environment. Its range of documented target types is valuable for mixed estates. Teams should look elsewhere if they need a hosted fuzzing service, cannot accommodate high memory, disk, or I/O demands, or cannot accept the AGPL terms or commercial-license cost.

Pros and cons

• Pros: Multiple compiler instrumentation modes and mutation features give teams flexibility in how they pursue coverage.
• Pros: Documentation covers source, binary-only, network, and GUI targets, with build options for source-only, binary-only, or combined distributions.
• Pros: Free use under AGPL includes study, modification, and distribution rights.
• Cons: Fuzzing can place heavy demands on hardware, memory, disk, and filesystem I/O.
• Cons: Three named modes do not work on macOS, narrowing the choices for Mac-based workflows.
• Cons: Modified network services must offer corresponding source under the AGPL; the commercial license costs €20,000 a year.

Alternatives

For stream-processing work rather than fuzz testing, Apache Beam offers an open-source programming model, with execution costs depending on the chosen runner and infrastructure. Apache NiFi is a free download under Apache License 2.0. Apache Storm is free and open source under Apache License 2.0. Arroyo is a self-hosted, single-binary engine under Apache 2.0. Feldera offers an open-source edition with a single node and container, full SQL support, all connectors, datasets larger than memory, and community support. Kafka Streams is free to download and has no formal or commercial support. Timeplus offers Proton as an open-source streaming SQL engine in a single binary under 500MB. Apache Spark is an open-source distributed data analytics engine with download, PyPI, Maven Central, and Docker options. These are stream-processing or data-analytics choices, not direct substitutes for AFL++'s fuzzing workflow.

Browse Stream Processing Software, Fuzz Testing Software, or Game Mod Managers to explore related categories.

Verdict

Choose AFL++ if you need a flexible local fuzzer for varied target types and can handle its resource demands and licensing terms. Its instrumentation and mutation breadth is the main reason to choose it; macOS mode gaps, substantial system load, and AGPL obligations are sound reasons to look elsewhere.