diff --git a/lib/core/dummy-callback.c b/lib/core/dummy-callback.c
index b5fa7656a..c3bdb66ae 100644
--- a/lib/core/dummy-callback.c
+++ b/lib/core/dummy-callback.c
@@ -164,7 +164,7 @@ lws_callback_http_dummy(struct lws *wsi, enum lws_callback_reasons reason,
 
 			wsi->reason_bf &= ~LWS_CB_REASON_AUX_BF__PROXY_HEADERS;
 
-			lwsl_notice("%s: %p: issuing proxy headers\n",
+			lwsl_debug("%s: %p: issuing proxy headers\n",
 				    __func__, wsi);
 			n = lws_write(wsi, wsi->http.pending_return_headers + LWS_PRE,
 				      wsi->http.pending_return_headers_len,
@@ -351,7 +351,7 @@ lws_callback_http_dummy(struct lws *wsi, enum lws_callback_reasons reason,
 
 		parent->reason_bf |= LWS_CB_REASON_AUX_BF__PROXY_HEADERS;
 
-		lwsl_notice("%s: LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP: prepared headers\n", __func__);
+		lwsl_debug("%s: LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP: prepared headers\n", __func__);
 		lws_callback_on_writable(parent);
 
 		break; }
diff --git a/lib/roles/cgi/cgi-server.c b/lib/roles/cgi/cgi-server.c
index cb80fc5a5..3105b704d 100644
--- a/lib/roles/cgi/cgi-server.c
+++ b/lib/roles/cgi/cgi-server.c
@@ -983,7 +983,7 @@ lws_cgi_kill(struct lws *wsi)
 				if (n < 0) {
 					n = kill(wsi->http.cgi->pid, SIGKILL);
 					if (n < 0)
-						lwsl_err("%s: SIGKILL PID %d "
+						lwsl_info("%s: SIGKILL PID %d "
 							 "failed errno %d "
 							 "(maybe zombie)\n",
 							 __func__,
diff --git a/lib/roles/http/client/client.c b/lib/roles/http/client/client.c
index 09acfbcf3..b11cb615d 100644
--- a/lib/roles/http/client/client.c
+++ b/lib/roles/http/client/client.c
@@ -1121,7 +1121,7 @@ lws_http_client_read(struct lws *wsi, char **buf, int *len)
 	lws_change_pollfd(wsi, 0, LWS_POLLIN);
 
 	if (rlen == LWS_SSL_CAPABLE_ERROR) {
-		lwsl_notice("%s: SSL capable error\n", __func__);
+		lwsl_debug("%s: SSL capable error\n", __func__);
 		return -1;
 	}
 
diff --git a/lib/roles/http/server/lws-spa.c b/lib/roles/http/server/lws-spa.c
index 70bbf7181..6d3a7ea3a 100644
--- a/lib/roles/http/server/lws-spa.c
+++ b/lib/roles/http/server/lws-spa.c
@@ -472,7 +472,7 @@ lws_urldecode_spa_cb(void *data, const char *name, char **buf, int len,
 		spa->params[n] = *buf;
 
 	if ((*buf) + len >= spa->end) {
-		lwsl_notice("%s: exceeded storage\n", __func__);
+		lwsl_info("%s: exceeded storage\n", __func__);
 		return -1;
 	}
 
diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
index f98f25e5f..b78ee9163 100644
--- a/lib/roles/http/server/server.c
+++ b/lib/roles/http/server/server.c
@@ -955,7 +955,7 @@ lws_http_action(struct lws *wsi)
 		wsi->http.rx_content_length = atoll(content_length_str);
 		if (!wsi->http.rx_content_length) {
 			wsi->http.content_length_explicitly_zero = 1;
-			lwsl_notice("%s: explicit 0 content-length\n",
+			lwsl_debug("%s: explicit 0 content-length\n",
 				    __func__);
 		}
 	}
@@ -1253,12 +1253,22 @@ lws_http_action(struct lws *wsi)
 		if (pcolon)
 			i.port = atoi(pcolon + 1);
 
-		lws_snprintf(rpath, sizeof(rpath) - 1, "/%s/%s", pslash + 1,
-			     uri_ptr + hit->mountpoint_len);
+		n = lws_snprintf(rpath, sizeof(rpath) - 1, "/%s/%s",
+				   pslash + 1, uri_ptr +
+				   	   	   hit->mountpoint_len);
 		lws_clean_url(rpath);
 		na = lws_hdr_total_length(wsi, WSI_TOKEN_HTTP_URI_ARGS);
 		if (na) {
-			char *p = rpath + strlen(rpath);
+			char *p = rpath + n;
+
+			if (na >= (int)sizeof(rpath) - n - 2) {
+				lwsl_info("%s: query string %d longer "
+					  "than we can handle\n", __func__,
+					  na);
+
+				return -1;
+			}
+
 			*p++ = '?';
 			lws_hdr_copy(wsi, p, &rpath[sizeof(rpath) - 1] - p,
 				     WSI_TOKEN_HTTP_URI_ARGS);
diff --git a/lib/tls/openssl/ssl.c b/lib/tls/openssl/ssl.c
index a3b0589d9..8f67832b8 100644
--- a/lib/tls/openssl/ssl.c
+++ b/lib/tls/openssl/ssl.c
@@ -252,7 +252,7 @@ lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 	 */
 	if (n <= 0) {
 		m = lws_ssl_get_error(wsi, n);
-		lwsl_notice("%p: ssl err %d errno %d\n", wsi, m, errno);
+		lwsl_debug("%p: ssl err %d errno %d\n", wsi, m, errno);
 		if (m == SSL_ERROR_ZERO_RETURN) /* cleanly shut down */
 			return LWS_SSL_CAPABLE_ERROR;