aria2 upstream has released latest 1.6.2 release, fixing one DoS issue. From 1.6.2 Release Note:

This release fixes segmentation fault error if URI to download contains printf format string and logging is enabled

* Fixed the bug that causes segmentation fault if req->getCurrentUrl() contains printf format string such as %d. The statement that causes this bug is useless and removed.


References:
-----------
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586
https://bugzilla.redhat.com/show_bug.cgi?id=529342

Upstream patch:
---------------
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572

Affected versions:
------------------
aria2-1.5.x && aria2-1.6.x (aria2-1.3.x is not vulnerable)

Could you allocate a CVE identifier?

Thanks && Regards, Jan.