# FIXTURE_ONLY: test cases for check-httpd-cve-2026-119618 (want_rc|args|expected text). All inputs are synthetic.
1|--version-output tests/fixtures/v_2462_unix.txt|VULNERABLE: input: httpd 2.4.62 is in the affected range 2.4.55 to 2.4.70 (Apache); fixed in 2.4.71. HTTP/2: not checked (pass --modules and --config). We expect exposure only where HTTP/2 is on (OUR INFERENCE).
1|--version-output tests/fixtures/v_2455_unix.txt|VULNERABLE: input: httpd 2.4.55 is in the affected range
1|--version-output tests/fixtures/v_2470_unix.txt|VULNERABLE: input: httpd 2.4.70 is in the affected range
0|--version-output tests/fixtures/v_2471_unix.txt|PATCHED: input: httpd 2.4.71 is at or above 2.4.71, the fixed release Apache names.
0|--version-output tests/fixtures/v_2472_unix.txt|PATCHED: input: httpd 2.4.72
0|--version-output tests/fixtures/v_2454_unix.txt|NOT AFFECTED: input: httpd 2.4.54 is below 2.4.55, outside the range Apache lists
0|--version-output tests/fixtures/v_2234_unix.txt|NOT AFFECTED: input: httpd 2.2.34 (2.2 has no mod_http2 and is end of life
3|--version-output tests/fixtures/v_300.txt|UNKNOWN: input: httpd 3.0.1 is not a 2.4 release.
3|--version-output tests/fixtures/v_garbage.txt|NOTE: input: no Apache version found in the -v output.
1|--version-output tests/fixtures/v_notag.txt|httpd version 2.4.66 from the httpd -v output.
1|--version-output tests/fixtures/v_2462_unix.txt --modules tests/fixtures/mods_h2.txt --config tests/fixtures/conf_h2|HTTP/2: http2_module is loaded and Protocols lists HTTP/2 at conf.d/vhost.conf:4 (h2 and h2c).
1|--version-output tests/fixtures/v_2462_unix.txt --modules tests/fixtures/mods_h2.txt --config tests/fixtures/conf_h2|NOTE: input: 1 Include lines seen; files outside the given config path are not read
1|--version-output tests/fixtures/v_2462_unix.txt --modules tests/fixtures/mods_h2.txt --config tests/fixtures/conf_h2|SECONDARY: input: CVE-2026-106023 (mod_md NULL pointer dereference, child process crash; Apache: important) affects 2.4.30 to 2.4.70 and md_module is loaded.
1|--version-output tests/fixtures/v_2470_unix.txt --modules tests/fixtures/mods_h2.txt --config tests/fixtures/conf_h2|SECONDARY: input: CVE-2026-109163 (mod_vhost_alias 1 byte stack buffer overwrite; Apache: low) affects 2.4.69 and 2.4.70 and vhost_alias_module is loaded.
1|--version-output tests/fixtures/v_2469_unix.txt|CVE-2026-109163 (mod_vhost_alias 1 byte stack buffer overwrite; Apache: low) affects 2.4.69 and 2.4.70 if mod_vhost_alias is loaded.
0|--version-output tests/fixtures/v_2462_unix.txt --config tests/fixtures/conf_off|NOT EXPOSED: input: HTTP/2 is off: no Protocols directive in the config files read lists h2 or h2c (Apache's default is Protocols http/1.1) (OUR INFERENCE
0|--version-output tests/fixtures/v_2462_unix.txt --config tests/fixtures/conf_off|The version is in the affected range, so update anyway; turning HTTP/2 on later would expose it.
0|--version-output tests/fixtures/v_2462_unix.txt --config tests/fixtures/conf_off|NOTE: input: 1 Protocols lines read, none with h2 or h2c.
0|--version-output tests/fixtures/v_2455_unix.txt --modules tests/fixtures/mods_noh2.txt|NOT EXPOSED: input: HTTP/2 is off: http2_module is not in the loaded modules list
0|--version-output tests/fixtures/v_2455_unix.txt --modules tests/fixtures/mods_noh2.txt|SECONDARY: input: CVE-2026-106023 (mod_md NULL pointer dereference, child process crash
1|--version-output tests/fixtures/v_2458_win64_bom_crlf.txt --config tests/fixtures/conf_noload --modules tests/fixtures/mods_empty.txt|HTTP/2: Protocols lists HTTP/2 at httpd.conf:2 (h2) (LoadModule http2_module not seen in the files read
1|--version-output tests/fixtures/v_2458_win64_bom_crlf.txt --config tests/fixtures/conf_noload --modules tests/fixtures/mods_empty.txt|NOTE: input: the modules file lists no modules (is it httpd -M output?).
1|--version-output tests/fixtures/v_2458_win64_bom_crlf.txt|build tag "Win64".
5|--version-output tests/fixtures/v_2458_ubuntu.txt --config tests/fixtures/conf_debian_on|DISTRO BACKPORT CHECK: input: this is a distribution or vendor build (build tag "Ubuntu"). Distributions backport fixes without changing the upstream version, so check the distribution's advisory for CVE-2026-119618; do not trust the version string. HTTP/2: http2_module is loaded and Protocols lists HTTP/2 at mods-enabled/http2.conf:3 (h2 and h2c).
0|--version-output tests/fixtures/v_2458_ubuntu.txt --config tests/fixtures/conf_debian_off|NOT EXPOSED: input: HTTP/2 is off
5|--version-output tests/fixtures/v_2458_ubuntu.txt|SECONDARY: input: the same Apache release fixes CVE-2026-106023 (mod_md; Apache: important) and CVE-2026-109163 (mod_vhost_alias; Apache: low); check the distribution advisory for both.
5|--version-output tests/fixtures/v_2458_cpanel.txt|this is a distribution or vendor build (build tag "cPanel")
5|--version-output tests/fixtures/v_2462_rhel.txt --packages tests/fixtures/pkgs_rpm.txt|(build tag "Red Hat Enterprise Linux", package httpd-2.4.62-4.el9_6.2.x86_64, mod_http2-2.0.26-7.el9_9.1.x86_64)
5|--packages tests/fixtures/pkgs_rpm.txt|NOTE: input: distribution HTTP/2 package: mod_http2-2.0.26-7.el9_9.1.x86_64.
5|--packages tests/fixtures/pkgs_dpkg_l.txt --modules tests/fixtures/mods_h2_only.txt|(package apache2 2.4.62-1~deb12u2). Distributions backport fixes
5|--packages tests/fixtures/pkgs_dpkg_l.txt --modules tests/fixtures/mods_h2_only.txt|HTTP/2: http2_module is loaded; Protocols not checked (pass --config).
5|--packages tests/fixtures/pkgs_dpkg_status|(package apache2-bin 2.4.58-1ubuntu8.5)
5|--packages tests/fixtures/pkgs_query.txt|(package apache2 2.4.71-1)
3|--packages tests/fixtures/pkgs_none.txt|NOTE: input: no httpd, apache2 or mod_http2 package in the package list.
0|--packages tests/fixtures/pkgs_rpm.txt --config tests/fixtures/conf_off|NOT EXPOSED: input: HTTP/2 is off
1|--binary tests/fixtures/httpd_fake.bin|Version read from the binary, so the build origin is unknown: if a distribution or vendor packaged it, treat this as DISTRO BACKPORT CHECK.
1|--binary tests/fixtures/httpd_fake.bin|NOTE: input: httpd version 2.4.66 from the binary, build tag "?".
3|--binary tests/fixtures/httpd_nover.bin --name fx-01|NOTE: fx-01: no Apache/2.x.y version string found in the binary.
0|--version-output tests/fixtures/v_2472_unix.txt --binary tests/fixtures/httpd_fake.bin|from the httpd -v output, build tag "Unix".
1|--version-output tests/fixtures/v_2454_unix.txt --mod-h2 2.0.30|VULNERABLE: input: standalone mod_h2 2.0.30 is in the affected range 2.0.8 to 2.0.42 (Apache), and the archived GitHub project has published no fixed release
1|--mod-h2 v2.0.8|VULNERABLE: input: standalone mod_h2 2.0.8 is in the affected range
1|--mod-h2 2.0.42|VULNERABLE: input: standalone mod_h2 2.0.42
0|--mod-h2 2.0.7|NOT AFFECTED: input: standalone mod_h2 2.0.7 is outside the affected range 2.0.8 to 2.0.42; httpd version unknown.
3|--mod-h2 2.0.43|NOTE: input: mod_h2 2.0.43 is newer than 2.0.42, the last GitHub release
0|--mod-h2 v2.0.42 --modules tests/fixtures/mods_noh2.txt|NOT EXPOSED: input: HTTP/2 is off: http2_module is not in the loaded modules list
3|--config tests/fixtures/conf_noload|UNKNOWN: input: no httpd version found (HTTP/2: Protocols lists HTTP/2 at httpd.conf:2 (h2)
0|--config tests/fixtures/conf_h2/httpd.conf|NOT EXPOSED: input: HTTP/2 is off
0|--config tests/fixtures/conf_h2/httpd.conf|Version unknown; patch anyway when you can.
3|--config tests/fixtures/conf_empty|NOTE: input: no *.conf or *.load files read under the config path.
3|--config tests/fixtures/conf_debian_off/mods-available|no *.conf or *.load files read under the config path.
1|--version-output tests/fixtures/v_2462_unix.txt --name fx-site-01|VULNERABLE: fx-site-01:
1|--version-output tests/fixtures/v_2462_unix.txt|ADVISORY (Apache, 11 Nov 2026): affects httpd 2.4.55 through 2.4.70 and mod_h2 from GitHub 2.0.8 through 2.0.42; fixed in httpd 2.4.71.
1|--version-output tests/fixtures/v_2462_unix.txt|Apache rates it critical; Apache and NVD publish no CVSS score.
4||Usage:
4|--bogus 1|Usage:
4|--name|Usage:
4|--name a --name b|Usage:
4|--mod-h2 2.0|ERROR: --mod-h2 takes a version like 2.0.42
4|--binary tests/fixtures/missing.bin|ERROR: cannot read file
4|--modules tests/fixtures/missing.txt --version-output tests/fixtures/v_2462_unix.txt|ERROR: cannot read file
4|--config tests/fixtures/missing|ERROR: cannot read config
