LibAFL
- title
- LibAFL
- type
- entity
- summary
- Rust framework for building coverage-guided fuzzers — composable stages, mutators, observers, and feedbacks instead of a fixed loop; descendant of AFL++ research
- tags
- rust, fuzzing, security
- created
- 2026-05-12
- updated
- 2026-05-12
LibAFL is a Rust library (and crate ecosystem) that ships fuzzer parts instead of a fuzzer. Stages, mutators, observers, feedbacks, schedulers, and corpora are all traits; you compose them into the fuzzer your target needs. The project came out of the AFL++ team and the AFLNet/CmpLog research lines, aiming to make it cheap to build domain-specific fuzzers that aren't AFL-shaped.
The architectural bet is that real-world fuzzing has too many target shapes (kernel, hypervisor, network, structured-input, grammar, differential, multi-target) for one binary's command-line flags to cover, so the right abstraction is library, not tool.
Used by:
- gosentry as the engine underneath a forked Go toolchain
- AFL++ as its experimental rewrite path
- Various academic and industry research fuzzers
Relation to grammar / structure-aware fuzzing
LibAFL doesn't ship a grammar engine itself; tools built on it (gosentry, others) typically pull in Nautilus for grammar mode and the structure-aware-fuzzing decoder pattern for typed inputs.