Fuzzing papers (DBMS)

A compilation of classic articles in the field of database management system (DBMS)fuzzing.

keywords

DBsec : Database security
logic : logic bugs   |   crash : crash bugs   |   perf. : performance bugs
Diff : Differencial oracle   |   Con-sol : Constraint-solving oracle   |   Meta : Metamorphic oracle
RDB : Relational Database
VDB : Vector Database   |   GDB : Gragh Databases   |   TSDB : Time Series Database
cov. : Coverage-guided testing   |   optim. : join optimization   |   trans. : transaction bugs

2025

SIGMOD

• Understanding and reusing test suites across database systems.
• CODD Constant optimization driven database system testing.

VLDB

• Fucci Fucci: Database Transaction Fuzzing via Random Conflict Construction and Multilevel Constraint Solving.
• Detecting Schema-Related Logic Bugs in Relational DBMSs via Equivalent Database Construction.
• trans. Simple Testing Can Expose Most Critical Transaction Bugs: Understanding and Detecting Write-Specific Serializability Violations in Database Systems

TDSC

• Improving multitasking DBMS fuzzing with more accurate coverage and testcase trimming.

EuroSys

• Understanding and detecting SQL function bugs: using simple boundary arguments to trigger hundreds of DBMS bugs.

ICSE

• PUPPY perf. PUPPY: finding performance degradation bugs in DBMSs via limited-optimization plan construction.
• Coni Coni: Detecting Database Connector Bugs via State-Aware Test Case Generation.

ISSTA

• Qtran QTRAN: extending metamorphic-oracle based logical bug detection techniques for multiple-DBMS dialect support.
• Detecting Isolation Anomalies in Relational DBMSs

ATC

• DDLumos: Understanding and Detecting Atomic DDL Bugs in DBMSs

arXiv25

• SQLxDiff Enhanced Differential Testing in Emerging Database Systems.
• SQLancer++ Scaling Automated Database System Testing.
• ShQveL Testing database systems with large language model synthesized fragments.
• LLM-based Dynamic Differential Testing for Database Connectors with Reinforcement Learning-Guided Prompt Selection.

OTHER

• CCFB logic [ICPC '25] Sembug: Detecting Logic Bugs in Dbms Through Generating Semantic-Aware Non-Optimizing Query

2024

SIGMOD

• Correlation joins over time series data streams utilizing complementary dimension reduction and transformation.
• DQP Keep It Simple: Testing Databases via Differential Query Plans.
• Spatter Finding Logic Bugs in Spatial Database Engines via Affine Equivalent Inputs.

VLDB

• Detecting metadata-related logic bugs in database systems via raw database construction.
• Semantic conformance testing of relational DBMS.

ICSE

• CERT CERT: finding performance issues in database systems through the lens of cardinality estimation.
• GQT Detecting logic bugs in graph database management systems via injective and surjective graph query transformation.
• Understanding Transaction Bugs in Database Systems.
• Testing Graph Database Systems via Equivalent Query Rewriting.
• Sedar Sedar: Obtaining High-Quality Seeds for DBMS Fuzzing via Cross-DBMS SQL Transfer.

ISSTA

• Testing gremlin-based graph database systems via query disassembling.
• SQLess SQLess: dialect-agnostic SQL query simplification.

TDSC

• Tuzz Improving Multitasking DBMS Fuzzing With More Accurate Coverage and Testcase Trimming.

ICST

• Differential optimization testing of gremlin-based graph database systems.

USENIX Security

• Towards Generic Database Management System Fuzzing.

ATC

• WingFuzz WingFuzz: Implementing Continuous Fuzzing for DBMSs.

OTHERS

• EET [OSDI '24] Detecting logic bugs in database engines via equivalent expression transformation.
• SQLaser [arXiv24] SQLaser: Detecting DBMS Logic Bugs with Clause-Guided Fuzzing.
• [Journal of Systems and Software ‘24(CCF B)] Database management system performance comparisons: a systematic literature review.
• SQLPass [COMPSAC '24] SQLPass: A Semantic Effective Fuzzing Method for DBMS.
• [FSE '24] When Fuzzing Meets LLMs: Challenges and Opportunities.

2023

SIGMOD

• TQS Detecting Logic Bugs of Join Optimizations in DBMS.
• DBPA DBPA: a benchmark for transactional database performance anomalies.

ICDE

• Lego Sequence-Oriented DBMS Fuzzing.

ICSE

• DQE Testing database systems via differential query execution.
• GDBMeter Detecting isolation bugs via transaction oracle construction.
• Coverage guided fault injection for cloud systems.
• Randomized differential testing of RDF stores.
• QPG Testing Database Engines via Query Plan Guidance.

ISSTA

• Testing graph database engines via query partitioning.
• GDsmith GDsmith: Detecting Bugs in Cypher Graph Database Engines.

EuroSys

• Model checking guided testing for distributed systems.

ATC

• Pinolo Pinolo: detecting logical bugs in database management systems with approximate query synthesis.

OTHERS

• [arXiv23] A Comprehensive Survey on Database Management System Fuzzing: Techniques, Taxonomy and Experimental Comparison.
• DynSQL [SEC '23] DynSQL: Stateful Fuzzing for Database Management Systems with Complex and Valid {SQL} Query Generation.
• [OSDI '23] Detecting transactional bugs in database engines via {graph-based} oracle construction.
• Squill [MDPI '23] Squill: Testing DBMS with Correctness Feedback and Accurate Instantiation.
• [ Go-Randgen ] [GITHUB] a QA tool to random generate sql by bnf pattern.

2022

ASE

• Griffin Griffin : Grammar-Free DBMS Fuzzing.
• DT2 Differentially Testing Database Transactions for Fun and Profit.

ICSE

• AMOEBA Automatic detection of performance bugs in database systems using equivalent queries.

ISSTA

• Unicorn Unicorn: detect runtime errors in time-series databases with hybrid input synthesis.
• Finding bugs in gremlin-based graph database systems via randomized differential testing.

USENIX Security

• Detecting logical bugs of DBMS with coverage-based guidance.

2021

• Artemis [Bench '20] Artemis: An Automatic Test Suite Generator for Large Scale OLAP Database.
• Eqsql [arXiv '21] Duplicate-sensitivity Guided Transformation Synthesis for DBMS Correctness Bug Detection.

2020

• PQS [OSDI '20] Testing database engines via pivoted query synthesis.
• NoREC [ESEC/FSE '20] Detecting Optimization Bugs in Database Engines via Non-optimizing Reference Engine Construction.
• SQUIRREL [CCS '20] SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback.
• TLP [OOPSLA '20] Finding Bugs in Database Systems via Query Partitioning.
• afl++ [WOOT '20] AFL++: combining incremental steps of fuzzing research.
• MutaSQL [DBTest '20] Testing query execution engines with mutations.

2019

VLDB

• APOLLO APOLLO: automatic detection and diagnosis of performance regressions in database systems.

2015

GITHUB

• SQLsmith A random SQL query generator.

2010

ASE

• ADUSA Automated SQL query generation for systematic testing of database engines.

2007

VLDB

• GARan A genetic approach for random testing of database systems.

1998

VLDB

• RAGS Massive Stochastic Testing of SQL.