diff --git a/src/tlshd/quic.c b/src/tlshd/quic.c
index 55c36fa..aeeab9f 100644
--- a/src/tlshd/quic.c
+++ b/src/tlshd/quic.c
@@ -360,16 +360,21 @@ static int quic_session_set_priority(gnutls_session_t session, uint32_t cipher)
 static int quic_session_set_alpns(gnutls_session_t session, char *alpn_data)
 {
 	gnutls_datum_t alpns[TLSHD_QUIC_MAX_ALPNS_LEN / 2];
-	char *alpn = strtok(alpn_data, ",");
+	char *saveptr = NULL;
+	char *alpn = strtok_r(alpn_data, ",", &saveptr);
 	int count = 0, ret;
 
 	while (alpn) {
 		while (*alpn == ' ')
 			alpn++;
+		if (count == TLSHD_QUIC_MAX_ALPNS_LEN / 2) {
+			tlshd_log_error("Too many ALPNs configured");
+			return -1;
+		}
 		alpns[count].data = (unsigned char *)alpn;
 		alpns[count].size = strlen(alpn);
 		count++;
-		alpn = strtok(NULL, ",");
+		alpn = strtok_r(NULL, ",", &saveptr);
 	}
 
 	ret = gnutls_alpn_set_protocols(session, alpns, count, GNUTLS_ALPN_MANDATORY);
diff --git a/src/tlshd/tags.c b/src/tlshd/tags.c
index 1a83c7c..0491ca6 100644
--- a/src/tlshd/tags.c
+++ b/src/tlshd/tags.c
@@ -1433,7 +1433,7 @@ tlshd_tags_filter_type_match_x509_tbs_version(struct tlshd_tags_filter *filter,
 		goto deinit;
 	}
 
-	snprintf(version, sizeof(version), "%u", ret);
+	snprintf(version, sizeof(version), "%d", ret);
 	res = tlshd_tags_filter_type_match_string(filter, version);
 	tlshd_log_debug("Filter '%s' %s version '%s'",
 			filter->fi_name,