
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2025-65947 is a resource exhaustion vulnerability in the thread-amount Rust crate (cargo package) caused by memory and handle leaks when querying thread counts on Windows and Apple (macOS/iOS) platforms. All versions prior to 0.2.2 are affected. The vulnerability was discovered and disclosed on November 21, 2025, with a patch released the same day. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).
The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-772 (Missing Release of Resource after Effective Lifetime). On Windows, the thread_amount function calls CreateToolhelp32Snapshot but never calls CloseHandle on the returned HANDLE, causing the process handle count to grow unboundedly with each invocation. On macOS/iOS, the function calls task_threads via Mach kernel APIs, which allocates memory for the thread list, but never calls vm_deallocate to free it, resulting in a steady memory leak. The fix (PR #29, commit 28860d4) adds CloseHandle after the Windows snapshot enumeration and calls mach_vm_deallocate after reading the thread count on Apple platforms (GitHub Advisory, Fix PR).
The primary impact is availability: long-running applications such as servers, daemons, or monitoring tools that periodically call thread_amount will progressively exhaust system resources. On Windows, handle exhaustion eventually causes process termination when the OS handle limit is reached; on macOS/iOS, the OOM killer terminates the process once memory is depleted. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data, and lateral movement is not applicable (GitHub Advisory).
Upgrade the thread-amount crate to version 0.2.2 or later, which adds proper CloseHandle calls on Windows and mach_vm_deallocate calls on Apple platforms. In Cargo.toml, update the dependency to thread-amount = "0.2.2" or thread-amount = "0.3" (latest). As a temporary workaround, limit or throttle calls to the thread_amount function in application code, and monitor process handle counts (Windows) and memory usage (macOS) for anomalous growth (GitHub Advisory, Fix PR, RustSec Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."