Rust prevents many memory bugs, but it does not prevent panics, logic errors, or mistakes inside unsafe blocks. cargo-fuzz wraps libFuzzer for Rust: install it, run cargo fuzz init, add a target, and run it. It needs a nightly compiler and runs on x86-64 and Aarch64 Unix-like systems.
Why fuzz safe Rust at all
A panic from an out-of-range index or an unwrap on bad input is a denial of service in a network service. Overflow behavior differs between debug and release builds. Code that calls C libraries or uses unsafe can still corrupt memory. A fuzzer finds these with real inputs, not guesses.
Setup
From the cargo-fuzz README:
cargo install cargo-fuzz
cargo fuzz init
cargo fuzz add parse_header
The tool needs a nightly compiler because it uses unstable flags, plus a C++ compiler. The README says libFuzzer needs LLVM sanitizer support, so it runs on x86-64 and Aarch64 Unix-like systems and not on Windows. In a Cargo workspace you either add the fuzz directory to the workspace members or run init with the independent workspace option.
Write the target
cargo fuzz add creates a file under the fuzz directory with a fuzz target macro and a closure that receives bytes. Your job is to call the function you want to test with those bytes. For a parser that takes a byte slice it is one line. For a function that needs structured input, the README mentions Arbitrary inputs and a cargo fuzz fmt command that prints the Debug output of a test case.
Keep the same rules as any harness: quick, deterministic, no printing, and no process exit.
Run and read it
cargo fuzz run parse_header
You see libFuzzer status lines as the run goes on. If the code panics, the input is saved and the run stops. The README describes these helpful commands:
cargo fuzz tmin parse_header <input>to minimize a failing inputcargo fuzz cmin parse_headerto minimize the corpuscargo fuzz coverage parse_headerto generate coverage information
Turn finds into regression tests
Copy the minimized input into your tests and assert the function now returns an error instead of panicking. That way the bug stays fixed even if nobody runs the fuzzer for months.
What Rust fuzzing will not catch
A fuzzer sees panics and crashes. It does not see a wrong answer unless you assert one. For logic, write checks inside the target: parse then serialize then parse again, and compare. That is the same property idea described in our Go post.
Where to run it
A short run in CI over the saved corpus, and longer scheduled runs elsewhere. The ClusterFuzzLite docs list Rust among supported languages, and OSS-Fuzz accepts rust as a project language value.
Quick check
Do I need nightly Rust to fuzz?
For cargo-fuzz, yes: the README says a nightly compiler is required because it uses unstable flags. Your normal builds can stay on stable.
Can cargo-fuzz run on Windows?
The README says it runs on x86-64 and Aarch64 Unix-like systems and not on Windows.
Sources
Last reviewed: 19 October 2026.
