Quartet of weaknesses include ancient vuln from 2009
Source: Two first-gen flaws carried over to HTTP/2, warn security bods