mod_http2 is still considered experimental, and the source of 2 of the 3 vulnerabilities announced for 2.4 this year.