See how aria2 compares to other vendors in security performance
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrenthelper.cc, which allows a remote malicious user to cause a Denial of Service