Low Severity
CVE-2021-41773
Published: Oct 25, 2026
Build reproducible vulnerable (and patched) target containers from templates, in a verified state, so you can validate any scanner, exploit, or detection rule against ground truth.
# vulnsuite
**Build vulnerable systems on purpose.** Point vulnsuite at a
template and it builds a reproducible, content-addressed Docker image of a
vulnerable system (and of its patched twin), runs it in a known state, and
proves that state with an independent verify probe — so you can validate any
scanner, exploit, or detection rule against ground truth instead of guesswork.
```
vulnsuite update-templates # fetch ruzfi/vulnsuite-templates
vulnsuite build -t web-servers # build every web-server target, 4 in parallel
vulnsuite run -t apache-httpd-2.4.49-cve-2021-41773 -expose host
# verify: ok -- confirmed vulnerable
# Scan these with your probe:
# apache-httpd-2.4.49-cve-2021-41773 [vulnerable] http://127.0.0.1:49152
```
The scanner is **not** part of vulnsuite. You bring your own.
## Why
Validating a vulnerability scanner means answering, for every template it
ships: *does it fire on a system that is really vulnerable, and stay quiet on
the same system once it is fixed?* Doing that by hand — finding the right
version, building it, breaking it, un-breaking it — does not scale past a
handful of CVEs. vulnsuite turns that work into a template anyone can
contribute once and everyone can run anywhere with Docker.
- **Templates are a portable contract.** One folder per target, a
`contract.yaml` plus the files it references. Nix-inspired: the base is
pinned (an image digest, or a source repo at a commit) and each state is
reached by a config overlay and/or a patch. Templates sharing a base reuse
one build.
- **Images are content-addressed.** A built image is tagged by a hash of its
inputs. Identical inputs never rebuild. `vulnsuite build -push` publishes
immutable `:<state>-<hash>` and moving `:<state>` tags to any registry.
- **Every run is verified.** A state's `verify` probes are written from the
advisory, not copied from a scanner's matcher. A target that does not pass
its own probe is not handed