{"id":"https://openalex.org/W7131420492","doi":"https://doi.org/10.48550/arxiv.2602.19490","title":"FuzzySQL: Uncovering Hidden Vulnerabilities in DBMS Special Features with LLM-Driven Fuzzing","display_name":"FuzzySQL: Uncovering Hidden Vulnerabilities in DBMS Special Features with LLM-Driven Fuzzing","publication_year":2026,"publication_date":"2026-02-23","ids":{"openalex":"https://openalex.org/W7131420492","doi":"https://doi.org/10.48550/arxiv.2602.19490"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2602.19490","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.19490","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2602.19490","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126679182","display_name":"Yongxin Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yongxin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126799146","display_name":"Zhiyuan Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Zhiyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126825972","display_name":"Chao Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Chao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126788951","display_name":"Haoran Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Haoran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084128665","display_name":"Shenglin Xu","orcid":"https://orcid.org/0000-0001-9533-4086"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Shenglin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126705450","display_name":"Jianping Tang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tang, Jianping","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085603076","display_name":"Z.J. Li","orcid":"https://orcid.org/0000-0002-5858-8279"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zheming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111933401","display_name":"Peidai Xie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xie, Peidai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5126846068","display_name":"Yongjun Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Yongjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.6503000259399414,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.6503000259399414,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.06700000166893005,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.048700001090765,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9506000280380249},{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.546500027179718},{"id":"https://openalex.org/keywords/sql","display_name":"SQL","score":0.4952000081539154},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.4848000109195709},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4672999978065491},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.41110000014305115},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.36910000443458557},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.3643999993801117}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9506000280380249},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8744999766349792},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.546500027179718},{"id":"https://openalex.org/C510870499","wikidata":"https://www.wikidata.org/wiki/Q47607","display_name":"SQL","level":2,"score":0.4952000081539154},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.4848000109195709},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4672999978065491},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.4507000148296356},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.41110000014305115},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3887999951839447},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3643999993801117},{"id":"https://openalex.org/C154420247","wikidata":"https://www.wikidata.org/wiki/Q846619","display_name":"Stored procedure","level":5,"score":0.3361999988555908},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.3222000002861023},{"id":"https://openalex.org/C2777561058","wikidata":"https://www.wikidata.org/wiki/Q2652119","display_name":"Program comprehension","level":4,"score":0.3165000081062317},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.3127000033855438},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.30410000681877136},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.28049999475479126},{"id":"https://openalex.org/C2780154230","wikidata":"https://www.wikidata.org/wiki/Q513420","display_name":"Undo","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2624000012874603},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.2615000009536743},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.25769999623298645},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.2556999921798706},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.25130000710487366}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2602.19490","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.19490","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2602.19490","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.19490","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7748238444328308,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Traditional":[0],"database":[1,223],"fuzzing":[2,67,215],"techniques":[3],"primarily":[4],"focus":[5],"on":[6],"syntactic":[7,138],"correctness":[8],"and":[9,98,104,139,153,187,209],"general":[10],"SQL":[11,81],"structures,":[12],"leaving":[13],"critical":[14],"yet":[15],"obscure":[16],"DBMS":[17,75,165],"features,":[18],"such":[19],"as":[20],"system-level":[21],"modes":[22],"(e.g.,":[23,27,32],"GTID),":[24],"programmatic":[25],"constructs":[26],"PROCEDURE),":[28],"advanced":[29],"process":[30],"commands":[31],"KILL),":[33],"largely":[34],"underexplored.":[35],"Although":[36],"rarely":[37],"triggered":[38],"by":[39,95,185],"typical":[40],"inputs,":[41],"these":[42],"features":[43],"can":[44],"lead":[45],"to":[46,70,163,191,216],"severe":[47],"crashes":[48],"or":[49],"security":[50],"issues":[51],"when":[52],"executed":[53],"under":[54],"edge-case":[55],"conditions.":[56],"In":[57],"this":[58,170],"paper,":[59],"we":[60],"present":[61],"FuzzySQL,":[62],"a":[63,87,121],"novel":[64,88],"LLM-powered":[65],"adaptive":[66],"framework":[68],"designed":[69],"uncover":[71],"subtle":[72],"vulnerabilities":[73,189],"in":[74,194,205,221],"special":[76,166],"features.":[77,167],"FuzzySQL":[78,119,144],"combines":[79],"grammar-guided":[80],"generation":[82],"with":[83,130,177],"logic-shifting":[84],"progressive":[85],"mutation,":[86],"technique":[89],"that":[90,126],"explores":[91],"alternative":[92],"control":[93],"paths":[94],"negating":[96],"conditions":[97],"restructuring":[99],"execution":[100,113],"logic,":[101],"synthesizing":[102],"structurally":[103],"semantically":[105],"diverse":[106],"test":[107],"cases.":[108],"To":[109],"further":[110],"ensure":[111],"deeper":[112],"coverage":[114,208],"of":[115,137,159,169,202,213],"the":[116,200,211],"back":[117],"end,":[118],"employs":[120],"hybrid":[122],"error":[123],"repair":[124],"pipeline":[125],"unifies":[127],"rule-based":[128],"patching":[129],"LLM-driven":[131],"semantic":[132,206],"repair,":[133],"enabling":[134],"automatic":[135],"correction":[136],"context-sensitive":[140],"failures.":[141],"We":[142],"evaluate":[143],"across":[145],"multiple":[146],"DBMSs,":[147],"including":[148],"MySQL,":[149],"MariaDB,":[150],"SQLite,":[151],"PostgreSQL":[152],"Clickhouse,":[154],"uncovering":[155],"64":[156],"vulnerabilities,":[157],"27":[158],"which":[160],"are":[161],"tied":[162],"under-tested":[164],"As":[168],"writing,":[171],"60":[172],"cases":[173],"have":[174],"been":[175],"confirmed":[176],"9":[178],"assigned":[179],"CVE":[180],"identifiers,":[181],"31":[182],"already":[183],"fixed":[184],"vendors,":[186],"additional":[188],"scheduled":[190],"be":[192],"patched":[193],"upcoming":[195],"releases.":[196],"Our":[197],"results":[198],"highlight":[199],"limitations":[201],"conventional":[203],"fuzzers":[204],"feature":[207],"demonstrate":[210],"potential":[212],"LLM-based":[214],"discover":[217],"deeply":[218],"hidden":[219],"bugs":[220],"complex":[222],"systems.":[224]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-02-26T00:00:00"}