diff --git a/.gitignore b/.gitignore
index 69bb249..41fc472 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 /mod_http2-1.10.10.tar.gz
 /mod_http2-1.10.12.tar.gz
 /mod_http2-1.10.13.tar.gz
+/mod_http2-1.10.16.tar.gz
diff --git a/mod_http2.spec b/mod_http2.spec
index 7d1de52..41609a0 100644
--- a/mod_http2.spec
+++ b/mod_http2.spec
@@ -2,8 +2,8 @@
 %{!?_httpd_mmn: %global _httpd_mmn %(cat %{_includedir}/httpd/.mmn 2>/dev/null || echo 0-0)}
 
 Name:		mod_http2
-Version:	1.10.13
-Release:	2%{?dist}
+Version:	1.10.16
+Release:	1%{?dist}
 Summary:	module implementing HTTP/2 for Apache 2
 Group:		System Environment/Daemons
 License:	ASL 2.0
@@ -51,6 +51,9 @@ make check
 %{_httpd_moddir}/mod_proxy_http2.so
 
 %changelog
+* Thu Mar 29 2018 Joe Orton <jorton@redhat.com> - 1.10.16-1
+- update to 1.10.16 (CVE-2018-1302)
+
 * Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.13-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 
diff --git a/sources b/sources
index 4f87751..6783c29 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mod_http2-1.10.13.tar.gz) = 42d09c7786976c715ad639c527d3494617d0297b441cc50ae1d9fd355396bf8af3989eb278a193b946dca7c1db86391be8bca13106089c567b448eb31c691012
+SHA512 (mod_http2-1.10.16.tar.gz) = 1a81a999c0022e460aa38f306fd24698a0c43e568a08b117ecb7ede79424f44c03d102692e5df0c6033dd0a0853e00305c1ab11e9dff323fe3b1ad8bcb880c32