[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83739-en":3,"doc-seo-83739-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83739,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","Graph-Aware Fuzzing for Graph Database Management Systems","Graph Database Management Systems (GDBMSs) are critical infrastructure for managing interconnected data, yet existing testing methods often rely on differential or metamorphic oracles that force query comparability across engines or transformations. This narrows exploration and leaves engine-specific runtime failures, such as crashes and memory errors, undercovered. GRAF proposes black-box fuzzing for GDBMS query engines, generating structurally valid Cypher queries from LLM-based parameterized skeletons using cascading graph-context dependency resolution, and guiding mutation with execution-state feedback to prioritize topology-dependent abnormal behaviors.","Graph-Aware Fuzzing for Graph Database Management Systems  \nYu Li 1 , Qiang Hu 1 , Yao Zhang 1 , Junjie Wang 1 , Hao Liu 1 , Rui Wang2 , Yongqiang Lyu 1  \n1 Tianjin University, Tianjin, China  \n2 Capital Normal University, Beijing, China  \n{liyu2025, qianghu, zzyy, [junjie.wang](junjie.wang}@tju.edu.cn)[}](junjie.wang}@tju.edu.cn)[@tju.edu.cn](junjie.wang}@tju.edu.cn)  \narXiv :2607 .0374 1v 1 [ cs . SE] 4 Jul 2026  \nAbstract—Graph Database Management Systems (GDBMSs) are essential infrastructure for managing interconnected data. Existing GDBMS testing methods primarily rely on differential and metamorphic testing. The result consistency oracles of these methods constrain inputs to queries that are comparable across engines or transformations, leaving single engine runtime failures, such as crashes and memory errors, insufficiently explored. Developing dedicated fuzzers for GDBMSs faces two key challenges: (1) generating valid and structurally diverse queries under complex graph constraints, and (2) guiding exploration to capture topology dependent execution behavior.  \nTo address these challenges, we propose GRAF, a black box fuzzing framework for GDBMS query engines. First, GRAF introduces graph context aware query generation based on cascading dependency resolution. It instantiates parameterized Cypher skeletons generated by a Large Language Model (LLM) by jointly resolving labels, relationship types, properties, values, and variable scopes against the active graph state. This process produces structurally diverse queries while eliminating syntactic and semantic violations. Second, GRAF applies five graph specific mutation operators guided by execution state feedback, including execution time, result size, and system status. This feedback steers exploration away from unproductive queries and expensive traversals, while prioritizing local mutations around abnormal executions.  \nWe evaluated GRAF against three existing approaches on six widely used GDBMSs. GRAF consistently improves line coverage by 31.6% to 41.1% over the strongest baseline on each target. In 12 hour fuzzing, it triggered 25 unique bugs, compared to six from all baselines combined. Overall, GRAF discovered 34 previously unknown bugs, with 32 confirmed by developers and 23 assigned CVEs.  \nIndex Terms—context aware, fuzzing, LLMs, GDBMS  \nI. INTRODUCTION  \nGraph Database Management Systems (GDBMSs), such as Neo4j [1], Memgraph [2], and RedisGraph [3], have become essential infrastructure for managing highly connected data. Unlike relational database management systems [4], [5] that rely on rigid schemas and table based joins, GDBMSs utilize the labeled property graph model to represent data naturally as nodes, relationships, and properties. This architecture simplifies the execution of complex multi hop queries, driving their adoption in domains like financial fraud detection, social network analysis, and real time recommendation [6] . As these applications depend on continuous availability, ensuring the reliability of the underlying database engine is paramount. Defects within a graph query engine can lead to system  \nfailures, including runtime crashes, memory corruption, and resource exhaustion.  \nGeneral DBMS fuzzers have proved effective for testing relational database systems. Tools such as SQLsmith [7] and SQLancer [8]–[10] generate SQL queries based on abstract syntax tree models or formal semantics, successfully exposing bugs in mature systems such as PostgreSQL [11] and SQLite [12] . More recent fuzzers, including SQUIRREL [13] and Griffin [14], further improve input validity by preserving syntax or exploiting database metadata. These successes show that fuzzing is an effective way to exercise deep database execution logic and expose runtime failures.  \nHowever, dedicated fuzzing techniques for GDBMSs remain underexplored. Existing approaches mainly rely on differential testing [15]–[17] and metamorphic testing [18]–[22] . Since these techniques are ","cbCaiqIU20aAlRsQ","https://ap.wps.com/l/cbCaiqIU20aAlRsQ","pdf",625719,2,1,12,"English","en",105,"# Introduction\n## Challenges in graph query fuzzing\n### Valid query generation under graph constraints\n### Guiding exploration for topology-dependent execution","[{\"question\":\"Why do differential and metamorphic testing methods inadequately cover GDBMS runtime failures?\",\"answer\":\"They depend on result consistency oracles, which require generated queries to be comparable across engines or transformations. This restricts the explored input space, leaving engine-specific failures like crashes and memory errors less explored.\"},{\"question\":\"How does GRAF generate valid and structurally diverse Cypher queries?\",\"answer\":\"GRAF uses graph context aware generation by resolving labels, relationship types, properties, values, and variable scopes against the active graph state, instantiating LLM-produced parameterized Cypher skeletons to avoid syntactic and semantic violations.\"},{\"question\":\"How does GRAF guide fuzzing to reach topology-dependent abnormal behavior?\",\"answer\":\"GRAF applies five graph-specific mutation operators driven by execution state feedback such as execution time, result size, and system status, steering away from unproductive queries and expensive traversals while prioritizing local mutations near abnormal executions.\"}]",1784190129,30,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"graph-aware-fuzzing-for-graph-database-management-systems","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/graph-aware-fuzzing-for-graph-database-management-systems/83739/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why do differential and metamorphic testing methods inadequately cover GDBMS runtime failures?","Question",{"text":75,"@type":76},"They depend on result consistency oracles, which require generated queries to be comparable across engines or transformations. This restricts the explored input space, leaving engine-specific failures like crashes and memory errors less explored.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does GRAF generate valid and structurally diverse Cypher queries?",{"text":80,"@type":76},"GRAF uses graph context aware generation by resolving labels, relationship types, properties, values, and variable scopes against the active graph state, instantiating LLM-produced parameterized Cypher skeletons to avoid syntactic and semantic violations.",{"name":82,"@type":73,"acceptedAnswer":83},"How does GRAF guide fuzzing to reach topology-dependent abnormal behavior?",{"text":84,"@type":76},"GRAF applies five graph-specific mutation operators driven by execution state feedback such as execution time, result size, and system status, steering away from unproductive queries and expensive traversals while prioritizing local mutations near abnormal executions.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":29,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]