curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2016-9594.json"