{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T16:38:11Z","timestamp":1784392691558,"version":"3.55.0"},"reference-count":75,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100000781","name":"European Research Council","doi-asserted-by":"publisher","award":["101045669"],"award-info":[{"award-number":["101045669"]}],"id":[{"id":"10.13039\/501100000781","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>\n                    Fuzzing is a widely used technique to automatically test software for potential faults. To fuzz software projects efficiently and effectively, software developers must use\n                    <jats:italic toggle=\"yes\">fuzz harnesses<\/jats:italic>\n                    , i.e., small programs that connect the fuzzer to the project\u2019s code under test. However, as projects evolve, it is unclear whether fuzz harnesses are maintained in lockstep or left to stagnate, and whether unmaintained fuzz harnesses gradually degrade in terms of code coverage and bug-finding effectiveness.\n                  <\/jats:p>\n                  <jats:p>In this paper, we focus on OSS-Fuzz, the largest continuous fuzzing platform in practice, which provides harnesses for 510 security-critical open-source C\/projects. These harnesses are usually contributed by project maintainers or external developers, yet their ongoing maintenance is not always ensured. Our analysis shows that, overall, harnesses exhibit only a small reduction in coverage and retain surprising longevity in their ability to uncover bugs. At the same time, we also identify cases where harnesses degrade, analyze their root causes and the involved semantics of the code changes, and categorize them systematically. Finally, we extend OSS-Fuzz and Fuzz Introspector, a companion project to investigate fuzzer performance, with new metrics to automatically detect harness degradation, enabling more effective monitoring of fuzzing quality in evolving projects.<\/jats:p>","DOI":"10.1145\/3808172","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"3746-3768","source":"Crossref","is-referenced-by-count":1,"title":["An Empirical Study of Fuzz Harness Degradation"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-0501-1249","authenticated-orcid":false,"given":"Philipp","family":"G\u00f6rz","sequence":"first","affiliation":[{"name":"Ruhr-University Bochum, Bochum, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-2097-9891","authenticated-orcid":false,"given":"Joschua","family":"Schilling","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7301-4567","authenticated-orcid":false,"given":"Nicolai","family":"Bissantz","sequence":"additional","affiliation":[{"name":"Ruhr-University Bochum, Bochum, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2783-1264","authenticated-orcid":false,"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[{"name":"MPI-SP, Bochum, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2015.7321186"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2016.01.012"},{"key":"e_1_2_1_3_1","first-page":"3197","article-title":"The analysis of current state of agile software development","volume":"97","author":"Atawneh Samer","year":"2019","unstructured":"Samer Atawneh. 2019. The analysis of current state of agile software development. Journal of Theoretical and Applied Information Technology 97, 22 (2019), 3197-3028.","journal-title":"Journal of Theoretical and Applied Information Technology"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3024671"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3340456"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2005.1553603"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/METRIC"},{"key":"e_1_2_1_8_1","unstructured":"International Software Testing Qualifications Board. 2024. Test Harness Definition. International Software Testing Qualifications Board. https:\/\/glossary.istqb.org\/en_US\/term\/test-harness"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0166-5316(01)00037-2"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2020.3016773"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409729"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510230"},{"key":"e_1_2_1_13_1","volume-title":"OSS-Fuzzgen: Automated Fuzzing of Open Source Java Projects. The Eighteenth International Conference on Software Engineering Advances (ICSEA 2023)","author":"Chan Sheung Chi","year":"2023","unstructured":"Sheung Chi Chan, Adam Korczynski, and David Korczynski. 2023. OSS-Fuzzgen: Automated Fuzzing of Open Source Java Projects. The Eighteenth International Conference on Software Engineering Advances (ICSEA 2023) (2023)."},{"key":"e_1_2_1_14_1","unstructured":"OSS-Fuzz Issue Tracker. https:\/\/bugs.chromium.org\/p\/oss-fuzz\/issues\/list."},{"key":"e_1_2_1_15_1","unstructured":"curl Project. 2024. curl: command line tool and library for transferring data with URL syntax. https:\/\/github.com\/curl\/ curl. Accessed: 2024-10-19."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00026"},{"key":"e_1_2_1_17_1","unstructured":"Fuzz Introspector. [n. d.]. Projects Overview. https:\/\/introspector.oss-fuzz.com\/projects-overview."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3605157.3605177"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.4324\/9780203793206"},{"key":"e_1_2_1_20_1","unstructured":"Google. [n. d.]."},{"key":"e_1_2_1_21_1","unstructured":"OSS-Fuzz Issue Tracker. https:\/\/issues.oss-fuzz.com\/issues."},{"key":"e_1_2_1_22_1","unstructured":"Google. 2017. OSS-Fuzz: Continuous Fuzzing for Open Source Software. Google. https:\/\/github.com\/google\/oss-fuzz"},{"key":"e_1_2_1_23_1","unstructured":"Google. 2024. Fuzz Introspector Repository. Google. https:\/\/github.com\/ossf\/fuzz-introspector"},{"key":"e_1_2_1_24_1","unstructured":"Google. 2024. GoogleTest -Google Testing and Mocking Framework. https:\/\/github.com\/google\/googletest. Accessed: 2024-10-27."},{"key":"e_1_2_1_25_1","unstructured":"Google. 2024. OSS-Fuzz: Accepting New Projects. Google. https:\/\/google.github.io\/oss-fuzz\/getting-started\/acceptingnew-projects\/"},{"key":"e_1_2_1_26_1","unstructured":"Google. 2024. OSS-Fuzz-Gen: AI-Powered Fuzzing: Breaking the Bug Hunting Barrier. Google. https:\/\/security.googleblog. com\/2023\/08\/ai-powered-fuzzing-breaking-bug-hunting.html"},{"key":"e_1_2_1_27_1","unstructured":"Google. 2024. OSS-Fuzz: Reward Program. Google. https:\/\/bughunters.google.com\/about\/rules\/open-source\/ 5097259337383936\/oss-fuzz-reward-program-rules"},{"key":"e_1_2_1_28_1","unstructured":"Google. 2024. OSS-Fuzz: Setting up a new project. Google. https:\/\/google.github.io\/oss-fuzz\/"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2018.290111318"},{"key":"e_1_2_1_30_1","volume-title":"29th USENIX Security Symposium. 2271-2287","author":"Ispoglou Kyriakos","year":"2020","unstructured":"Kyriakos Ispoglou, Daniel Austin, Vishwath Mohan, and Mathias Payer. 2020. FuzzGen: Automatic fuzzer generation. In 29th USENIX Security Symposium. 2271-2287."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-8024-6"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179394"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24334"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2009.16"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3678722.3685534"},{"key":"e_1_2_1_37_1","unstructured":"Dmitrii Kuvaiskii. 2024. OSS-Fuzz Issue #13413: Misleading coverage reports due to missing coverage baselining. https:\/\/github.com\/google\/oss-fuzz\/issues\/13413. Accessed: 2025-09-10."},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2018.8330260"},{"key":"e_1_2_1_40_1","unstructured":"LLVM. 2024. libFuzzer -A library for coverage-guided fuzz testing. LLVM. https:\/\/llvm.org\/docs\/LibFuzzer.html"},{"key":"e_1_2_1_41_1","unstructured":"LLVM. 2024. Source-based Code Coverage. Clang Documentation. LLVM. https:\/\/clang.llvm.org\/docs\/ SourceBasedCodeCoverage.html"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670396"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSMR.2012.35"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611668"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/3688842"},{"key":"e_1_2_1_46_1","unstructured":"OSS-Fuzz. [n. d.]. Curl Build Failure. https:\/\/bugs.chromium.org\/p\/oss-fuzz\/issues\/detail?id=53965"},{"key":"e_1_2_1_47_1","unstructured":"OSS-Fuzz. 2019. Coverage Reports for Solidity. Before: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/solidity\/ reports\/20190303\/linux\/src\/solidity\/report.html After: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/solidity\/ reports\/20190304\/linux\/src\/solidity\/report.html."},{"key":"e_1_2_1_48_1","unstructured":"OSS-Fuzz. 2020. Coverage Reports for Arrow. Before: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/arrow\/reports\/ 20200825\/linux\/src\/arrow\/cpp\/src\/arrow\/util\/report.html After: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ arrow\/reports\/20200826\/linux\/src\/arrow\/cpp\/src\/arrow\/util\/report.html."},{"key":"e_1_2_1_49_1","unstructured":"OSS-Fuzz. 2020. Coverage Reports for Open62541. Before: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ open62541\/reports\/20200111\/linux\/src\/open62541\/src\/ua_connection.c.html#L156 After: https:\/\/storage.googleapis. com\/oss-fuzz-coverage\/open62541\/reports\/20200112\/linux\/src\/open62541\/src\/ua_connection.c.html#L160."},{"key":"e_1_2_1_50_1","unstructured":"OSS-Fuzz. 2020. Coverage Reports for Wuffs. Before: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/wuffs\/reports\/ 20200205\/linux\/src\/wuffs\/release\/c\/report.html After: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/wuffs\/reports\/ 20200206\/linux\/src\/wuffs\/release\/c\/report.html."},{"key":"e_1_2_1_51_1","unstructured":"OSS-Fuzz. 2021. Coverage Report for grpc-httpjson-transcoding. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ grpc-httpjson-transcoding\/reports\/20210922\/linux\/proc\/self\/cwd\/report.html."},{"key":"e_1_2_1_52_1","unstructured":"OSS-Fuzz. 2021. Coverage Report for grpc-httpjson-transcoding. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ grpc-httpjson-transcoding\/reports\/20210927\/linux\/proc\/self\/cwd\/report.html."},{"key":"e_1_2_1_53_1","unstructured":"OSS-Fuzz. 2022. Coverage Reports for Zydis. Before: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/zydis\/reports\/ 20220102\/linux\/src\/zydis\/tools\/ZydisFuzzDecoder.c.html#L61 After: https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ zydis\/reports\/20220103\/linux\/src\/zydis\/tools\/ZydisFuzzDecoder.c.html#L61 Recovered: https:\/\/storage.googleapis. com\/oss-fuzz-coverage\/zydis\/reports\/20230916\/linux\/src\/zydis\/tools\/ZydisFuzzDecoder.c.html#L61."},{"key":"e_1_2_1_54_1","unstructured":"OSS-Fuzz. 2023. Coverage Report for grpc-httpjson-transcoding. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/ grpc-httpjson-transcoding\/reports\/20230701\/linux\/proc\/self\/cwd\/report.html."},{"key":"e_1_2_1_55_1","unstructured":"OSS-Fuzz. 2023. Coverage Report for Sudoers. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/sudoers\/reports\/ 20230104\/linux\/src\/sudo\/plugins\/sudoers\/regress\/fuzz\/fuzz_sudoers.c.html#L190."},{"key":"e_1_2_1_56_1","unstructured":"OSS-Fuzz. 2023. Coverage Report for Sudoers. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/sudoers\/reports\/ 20230105\/linux\/src\/sudo\/plugins\/sudoers\/regress\/fuzz\/fuzz_sudoers.c.html#L190."},{"key":"e_1_2_1_57_1","unstructured":"OSS-Fuzz. 2025. Coverage for Curl on 2022-11-30. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/curl\/reports\/ 20221130\/linux\/src\/report.html"},{"key":"e_1_2_1_58_1","unstructured":"OSS-Fuzz. 2025. Coverage for Curl on 2022-12-01. https:\/\/storage.googleapis.com\/oss-fuzz-coverage\/curl\/reports\/ 20221201\/linux\/src\/report.html"},{"key":"e_1_2_1_59_1","unstructured":"OpenSSL Project. 2024. OpenSSL: TLS\/SSL and crypto library. https:\/\/github.com\/openssl\/openssl. Accessed: 2024-10-19."},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00137"},{"key":"e_1_2_1_61_1","unstructured":"Kostya Serebryany. 2017. OSS-Fuzz-Google's Continuous Fuzzing Service for Open Source Software."},{"key":"e_1_2_1_62_1","volume-title":"AddressSanitizer: A Fast Address Sanity Checker. In USENIX Annual Technical Conference (ATC).","author":"Serebryany Konstantin","year":"2012","unstructured":"Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. In USENIX Annual Technical Conference (ATC)."},{"key":"e_1_2_1_63_1","unstructured":"Daniel Stenberg. 2024. cURL HTTP\/3 Security Audit. https:\/\/daniel.haxx.se\/blog\/2024\/02\/23\/curl-http-3-security-audit\/. Accessed: 2025-09-11."},{"key":"e_1_2_1_64_1","unstructured":"sudo Project. 2024. sudo: Utility to execute a command as another user. https:\/\/github.com\/sudo-project\/sudo. Accessed: 2024-10-19."},{"key":"e_1_2_1_65_1","unstructured":"Michael Sutton Adam Greene and Pedram Amini. 2007. Fuzzing: brute force vulnerability discovery. Pearson Education."},{"key":"e_1_2_1_66_1","unstructured":"Tree-Sitter Community 2024. Tree-sitter. A Parser Generator Tool. Documentation. Tree-Sitter Community. https:\/\/treesitter.github.io\/"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341161.3343520"},{"key":"e_1_2_1_68_1","first-page":"41","article-title":"Agile development: Mainstream adoption has changed agility","volume":"2","author":"West Dave","year":"2010","unstructured":"Dave West, Tom Grant, Mary Gerush, and David D'Silva. 2010. Agile development: Mainstream adoption has changed agility. Forrester Research 2, 1 (2010), 41.","journal-title":"Forrester Research"},{"key":"e_1_2_1_69_1","volume-title":"2022 7th IEEE International Conference on Data Science in Cyberspace (DSC). IEEE, 375-382","author":"Yan Qian","year":"2022","unstructured":"Qian Yan, Minhuan Huang, and Huayang Cao. 2022. A survey of human-machine collaboration in fuzzing. In 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC). IEEE, 375-382."},{"key":"e_1_2_1_70_1","volume-title":"The Fuzzing Book","author":"Zeller Andreas","year":"2024","unstructured":"Andreas Zeller, Rahul Gopinath, Marcel B\u00f6hme, Gordon Fraser, and Christian Holler. 2024. The Fuzzing Book. CISPA Helmholtz Center for Information Security. https:\/\/www.fuzzingbook.org\/ Retrieved 2024-07-01 16:50:18+02:00."},{"key":"e_1_2_1_71_1","volume-title":"Automata-Guided Control-Flow-Sensitive Fuzz Driver Generation. In USENIX Security Symposium. 2867-2884","author":"Zhang Cen","year":"2023","unstructured":"Cen Zhang, Yuekang Li, Hao Zhou, Xiaohan Zhang, Yaowen Zheng, Xian Zhan, Xiaofei Xie, Xiapu Luo, Xinghua Li, Yang Liu, et al. 2023. Automata-Guided Control-Flow-Sensitive Fuzz Driver Generation. In USENIX Security Symposium. 2867-2884."},{"key":"e_1_2_1_72_1","first-page":"2811","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Zhang Cen","year":"2021","unstructured":"Cen Zhang, Xingwei Lin, Yuekang Li, Yinxing Xue, Jundong Xie, Hongxu Chen, Xinlei Ying, Jiashui Wang, and Yang Liu. 2021. APICraft: Fuzz driver generation for closed-source SDK libraries. In 30th USENIX Security Symposium (USENIX Security 21). 2811-2828."},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00041"},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP58684.2023.00013"},{"key":"e_1_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484596"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3808172","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:50:16Z","timestamp":1782841816000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3808172"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":75,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3808172"],"URL":"https:\/\/doi.org\/10.1145\/3808172","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}