We're are of a critical vulnerability in http2, which could lead to remote code execution. There is no evidence of successful exploitation in the wild but we are going to disable this module temporarily whilst a patch is released by WebPros.