{"id":"CVE-2025-65947","aliases":["GHSA-jf9p-2fv9-2jp2","RUSTSEC-2025-0125"],"url":"https://o3.security/vulnerability/CVE-2025-65947","summary":"thread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS","details":"Affected versions of this crate contain resource leaks when querying thread counts on Windows and Apple platforms.\n\n### Windows\nThe `thread_amount` function calls `CreateToolhelp32Snapshot` but fails to close the returned `HANDLE` using `CloseHandle`. Repeated calls to this function will cause the handle count of the process to grow indefinitely, eventually leading to system instability or process termination when the handle limit is reached.\n\n### macOS / iOS\nThe `thread_amount` function calls `task_threads` (via Mach kernel APIs) which allocates memory for the thread list. The function fails to deallocate this memory using `vm_deallocate`. Repeated calls will result in a steady memory leak, eventually causing the process to be killed by the OOM (Out of Memory) killer.\n\n### Impact\nLong-running applications (such as servers, daemons, or monitoring tools) that use this crate to periodically check thread counts will eventually crash due to resource exhaustion.\n\n### Resources\n\n- https://github.com/jzeuzs/thread-amount/pull/29","published":"2025-11-21T22:15:30.181Z","modified":"2026-08-12T03:51:09.933662598Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"thread-amount","fixedVersion":"0.2.2"}],"fix":{"url":"https://github.com/jzeuzs/thread-amount/commit/28860d4a38286609cb884c13b5b7941edc2390e5","label":"jzeuzs/thread-amount@28860d4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65947.json"},{"type":"ADVISORY","url":"https://github.com/jzeuzs/thread-amount/security/advisories/GHSA-jf9p-2fv9-2jp2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65947"},{"type":"FIX","url":"https://github.com/jzeuzs/thread-amount/commit/28860d4a38286609cb884c13b5b7941edc2390e5"},{"type":"FIX","url":"https://github.com/jzeuzs/thread-amount/pull/29"},{"type":"PACKAGE","url":"https://github.com/jzeuzs/thread-amount"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0125.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.933662598Z"}}