Does Programming Language Matter? An Empirical Study of Fuzzing Bug Detection

2026-02-05

AI Summary

This study investigates whether programming languages influence the effectiveness of continuous fuzzing in detecting vulnerabilities and bugs. Leveraging the OSS-Fuzz platform, we conduct a cross-language empirical analysis of 61,444 fuzzing-induced defects and 999,248 build records, offering the first systematic evidence that language design significantly shapes fuzzing behavior and outcomes. Our findings reveal that C++ and Rust exhibit high bug detection rates; Rust and Python show low vulnerability proportions but those identified are more critical; Go suffers from a higher prevalence of non-reproducible defects, whereas Rust exhibits almost none; and Python achieves high patch coverage yet incurs longer detection latency. These results provide an empirical foundation and actionable insights for developing language-aware fuzzing strategies.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Computer Vision: Language and Vision
• Reasoning under Uncertainty: Probabilistic Programming

Application Category

• Web Mining and Content Analysis: Mining multimedia, multimodal, multilingual, cross-lingual Web data
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Security and Privacy: Large-scale security measurements

Abstract

Fuzzing has become a popular technique for automatically detecting vulnerabilities and bugs by generating unexpected inputs. In recent years, the fuzzing process has been integrated into continuous integration workflows (i.e., continuous fuzzing), enabling short and frequent testing cycles. Despite its widespread adoption, prior research has not examined whether the effectiveness of continuous fuzzing varies across programming languages. This study conducts a large-scale cross-language analysis to examine how fuzzing bug characteristics and detection efficiency differ among languages. We analyze 61,444 fuzzing bugs and 999,248 builds from 559 OSS-Fuzz projects categorized by primary language. Our findings reveal that (i) C++ and Rust exhibit higher fuzzing bug detection frequencies, (ii) Rust and Python show low vulnerability ratios but tend to expose more critical vulnerabilities, (iii) crash types vary across languages and unreproducible bugs are more frequent in Go but rare in Rust, and (iv) Python attains higher patch coverage but suffers from longer time-to-detection. These results demonstrate that fuzzing behavior and effectiveness are strongly shaped by language design, providing insights for language-aware fuzzing strategies and tool development.

Problem

• fuzzing
• programming language
• bug detection
• continuous fuzzing
• vulnerability

Innovation

• fuzzing
• programming languages
• empirical study
• continuous fuzzing
• bug detection