GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
[ { "events": [ { "introduced": "0" }, { "last_affected": "1.6" } ] } ]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16165.json"