This was a significant flaw in the then-experimental HTTP/2 module ( mod_http2 ). It allowed remote attackers to bypass certificate-based authentication, potentially exposing sensitive admin panels. HTTP/2 Denial of Service (CVE-2016-1546)