A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2019-5436.json"