An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-18751.json"