Hi, I can confirm this issue/bug in mod_http2. Occasional segmentation faults when using mod_http2, reproducible by frequently accessing vhosts with enabled h2 support.
I was also able to resolve it by upgrading mod_http2 to the version included in Apache 2.4.29. Coredump backtrace from segfaulted standard Debian (Stretch) 2.4.25 mod_http2 (for what it's worth): #0 h2_stream_out_prepare (stream=stream@entry=0x7f19584550a0, plen=plen@entry=0x7f1959ea2a00, peos=peos@entry=0x7f1959ea29fc, presponse=presponse@entry=0x7f1959ea2a08) at h2_stream.c:604 [Current thread is 1 (Thread 0x7f1959ea3700 (LWP 15463))] (gdb) bt full #0 h2_stream_out_prepare (stream=stream@entry=0x7f19584550a0, plen=plen@entry=0x7f1959ea2a00, peos=peos@entry=0x7f1959ea29fc, presponse=presponse@entry=0x7f1959ea2a08) at h2_stream.c:604 c = <optimized out> status = <optimized out> requested = <optimized out> b = <optimized out> e = <optimized out> #1 0x00007f19744786cb in on_stream_resume (ctx=0x7f195849f0a0, stream=0x7f19584550a0) at h2_session.c:1576 session = 0x7f195849f0a0 status = <optimized out> rv = <optimized out> len = 0 eos = 0 headers = 0x0 #2 0x00007f197446fe3b in h2_mplx_dispatch_master_events (m=0x7f195849f2d0, on_resume=on_resume@entry=0x7f1974478500 <on_stream_resume>, on_ctx=on_ctx@entry=0x7f195849f0a0) at h2_mplx.c:1379 status = 0 acquired = 1 ids = {85, 75, 87, 73, 79, 77, 39, 53, 89, 91, 23, 93, 95, 97, 99, 101, 103, 107, 105, 109, 111, 123, 125, 119, 121, 115, 117, 113, 127, 129, 131, 133, 135, 137, 139, 141, 143, 145, 147, 149, 151, 153, 155, 157, 0, 32767, 0, 0, 58, 1, 0, 0, 0, 0, -1010297088, -1897350404, 1, 0, 1481241560, 32537, 1, 0, 1481241904, 32537, 1481241896, 32537, 8000, 0, 1784734664, 32537, 1950777061, 32537, 1508518904, 32537, 1508518896, 32537, 58, 0, 1508518912, 32537, 1508519092, 32537, -1, -1, 1784725616, 32537, 58, 0, 58, 0, -1010297088, -1897350404, 1481241296, 32537, 1481240736, 32537, 0, 0, 0, 0} stream = <optimized out> i = 43 n = 44 #3 0x00007f19744797ab in h2_session_process (session=0x7f195849f0a0, async=async@entry=0) at h2_session.c:2210 status = 0 c = 0x7f196a6112c8 rv = <optimized out> mpm_state = 1 trace = 0 #4 0x00007f1974465b2a in h2_conn_run (ctx=ctx@entry=0x7f196a60e2f8, c=c@entry=0x7f196a6112c8) at h2_conn.c:212 status = <optimized out> mpm_state = 0 #5 0x00007f197446ba5b in h2_h2_process_conn (c=0x7f196a6112c8) at h2_h2.c:658 status = <optimized out> ctx = 0x7f196a60e2f8 c = 0x7f196a6112c8 #6 0x0000563011b2c730 in ap_run_process_connection (c=c@entry=0x7f196a6112c8) at connection.c:42 pHook = <optimized out> n = 2 rv = -1 #7 0x0000563011b2cc80 in ap_process_connection (c=c@entry=0x7f196a6112c8, csd=csd@entry=0x7f196a6110b0) at connection.c:226 rc = <optimized out> #8 0x00007f1973338e4a in process_socket (bucket_alloc=0x7f19584b9028, my_thread_num=4, my_child_num=2, sock=0x7f196a6110b0, p=0x7f196a611028, thd=0x7f197af2dc78) at worker.c:631 current_conn = 0x7f196a6112c8 conn_id = <optimized out> sbh = 0x7f196a6112c0 #9 worker_thread (thd=0x7f197af2dc78, dummy=<optimized out>) at worker.c:992 ti = <optimized out> process_slot = 2 thread_slot = 4 csd = 0x7f196a6110b0 bucket_alloc = 0x7f19584b9028 last_ptrans = <optimized out> ptrans = 0x7f196a611028 rv = <optimized out> is_idle = 0 #10 0x00007f197a557494 in start_thread (arg=0x7f1959ea3700) at pthread_create.c:333 __res = <optimized out> pd = 0x7f1959ea3700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139746859431680, -6524335721044288688, 0, 139746901392863, 0, 139747414900800, 6577037691194661712, 6576965816350759760}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> __PRETTY_FUNCTION__ = "start_thread" #11 0x00007f197a299aff in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 No locals.