HTTP2 is a new technology that will soon see widespread use across the internet. There has been little research into this new protocol from a security perspective yet multiple adoptions and code bases already exist. HTTP2 lives in browsers, caching proxies, and libraries. It is the undisputed future of internet connections and so vulnerabilities in this protocol have the potential to cripple infrastructure across the globe. We will present our research on the current state of the HTTP2 protocol from a security perspective. We will focus on threats, attack vectors, and vulnerabilities found during the course of our research. Two Firefox and two Apache Traffic Server (ATS) vulnerabilities will be discussed alongside the release of the first public HTTP2 fuzzer. We will show how the bugs were found, what they are, why they occur and how to trigger them.