At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.

If it was even enabled that is.