SemFuzz: A Semantics-Aware Fuzzing Framework for Network Protocol Implementations
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917317847285760 |
|---|---|
| author | Sun, Yanbang Luo, Quan Wang, Yuelin Chen, Qian Liu, Benjin Chen, Ruiqi Huang, Qing Li, Xiaohong Wang, Junjie |
| author_facet | Sun, Yanbang Luo, Quan Wang, Yuelin Chen, Qian Liu, Benjin Chen, Ruiqi Huang, Qing Li, Xiaohong Wang, Junjie |
| contents | Network protocols are the foundation of modern communication, yet their implementations often contain semantic vulnerabilities stemming from inadequate understanding of specification semantics. Existing gray-box and black-box testing approaches lack semantic modeling of protocols, making it difficult to precisely express testing intent and cover boundary conditions. Moreover, they typically rely on coarse-grained oracles such as crashes, which are inadequate for identifying deep semantic vulnerabilities. To address these limitations, we present a semantics-aware fuzzing framework, SemFuzz. The framework leverages large language models to extract structured semantic rules from RFC documents and generates test cases that intentionally violate these rules to encode specific testing intents. It then detects deep semantic vulnerabilities by comparing the observed responses with the expected ones. Evaluation on seven widely deployed protocol implementations shows that SemFuzz identified sixteen potential vulnerabilities, ten of which have been confirmed. Among the confirmed vulnerabilities, five were previously unknown and four have been assigned CVEs. These results demonstrate the effectiveness of SemFuzz in detecting semantic vulnerabilities. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2603_05989 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | SemFuzz: A Semantics-Aware Fuzzing Framework for Network Protocol Implementations Sun, Yanbang Luo, Quan Wang, Yuelin Chen, Qian Liu, Benjin Chen, Ruiqi Huang, Qing Li, Xiaohong Wang, Junjie Cryptography and Security Computers and Society Network protocols are the foundation of modern communication, yet their implementations often contain semantic vulnerabilities stemming from inadequate understanding of specification semantics. Existing gray-box and black-box testing approaches lack semantic modeling of protocols, making it difficult to precisely express testing intent and cover boundary conditions. Moreover, they typically rely on coarse-grained oracles such as crashes, which are inadequate for identifying deep semantic vulnerabilities. To address these limitations, we present a semantics-aware fuzzing framework, SemFuzz. The framework leverages large language models to extract structured semantic rules from RFC documents and generates test cases that intentionally violate these rules to encode specific testing intents. It then detects deep semantic vulnerabilities by comparing the observed responses with the expected ones. Evaluation on seven widely deployed protocol implementations shows that SemFuzz identified sixteen potential vulnerabilities, ten of which have been confirmed. Among the confirmed vulnerabilities, five were previously unknown and four have been assigned CVEs. These results demonstrate the effectiveness of SemFuzz in detecting semantic vulnerabilities. |
| title | SemFuzz: A Semantics-Aware Fuzzing Framework for Network Protocol Implementations |
| topic | Cryptography and Security Computers and Society |
| url | https://arxiv.org/abs/2603.05989 |