ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-19396.json"