“A critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server.”
CVSS 9.8. No login needed. The bad range runs from 2.4.55 through 2.4.70, which is years of releases sitting on servers nobody has touched since install. The fix is 2.4.71. Patch tonight, because the attackers are reading the same advisory you are.