Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2019-16866.json"