Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Apache HTTP Server 2.4.71 fixes a critical HTTP/2 flaw that could allow unauthenticated remote code execution on servers with HTTP/2 enabled.
More info