MediumFix available
ruby — security advisory
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
- Products
- ruby
- Affected versions
- Not specified
- Fixed versions
- 2.5.8-r0, 2.6.6-r0
- CVEs
- CVE-2020-10933
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:00 UTC · Revision 1
Source evidence
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
osv:ALPINE-CVE-2020-10933
ruby
Fixed versions: 2.5.8-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.6.6-r0
ruby
Fixed versions: 2.5.8-r0
ruby
Fixed versions: 2.5.8-r0
Complete source record
{
"id": "3bb2ef6d51172bfd3c0e8effedaef9dee5dee2bb4cbb8e6aae73e4239f9e094d",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-10933",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2020-10933",
"summary": "An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.",
"evidence": "osv:ALPINE-CVE-2020-10933",
"products": [
{
"name": {
"value": "ruby",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.8-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.6-r0",
"evidence": "/affected/14/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/15/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.8-r0",
"evidence": "/affected/15/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/16/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.8-r0",
"evidence": "/affected/16/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2020-10933",
"aliases": [
"ALPINE-CVE-2020-10933"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.8-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.10"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.11"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.12"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.8-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.8"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.8-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.9"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-10933.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T11:17:55.098065997Z",
"provider": "osv",
"upstream": [
"CVE-2020-10933"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2020-10933"
]
},
"related_cves": [
{
"value": "CVE-2020-10933",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 450343,
"published_at": "2020-05-04T15:15:13.963+00:00"
}