Very interesting! > Strangely, these bugs were found by the CI of ClickHouse, and not by any of the hundreds of other products using these libraries. A lot of

Very interesting! > Strangely, these bugs were found by the CI of ClickHouse, and not by any of the hundreds of other products using these libraries. A lot of software projects that have "OSS Fuzz integration" have very naive or superficial fuzz harnesses that couldn't ever get thorough coverage. If the code is never executed by the fuzzer, bugs won't be found by fuzzing. In your case, fuzzing your application code, you likely end up executing code in those dependencies that their own fuzzers miss.