CVE-2025-65947: 
Rust vulnerability analysis and mitigation

CVE-2025-65947 is a resource exhaustion vulnerability in the thread-amount Rust crate (cargo package) caused by memory and handle leaks when querying thread counts on Windows and Apple (macOS/iOS) platforms. All versions prior to 0.2.2 are affected. The vulnerability was discovered and disclosed on November 21, 2025, with a patch released the same day. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-772 (Missing Release of Resource after Effective Lifetime). On Windows, the thread_amount function calls CreateToolhelp32Snapshot but never calls CloseHandle on the returned HANDLE, causing the process handle count to grow unboundedly with each invocation. On macOS/iOS, the function calls task_threads via Mach kernel APIs, which allocates memory for the thread list, but never calls vm_deallocate to free it, resulting in a steady memory leak. The fix (PR #29, commit 28860d4) adds CloseHandle after the Windows snapshot enumeration and calls mach_vm_deallocate after reading the thread count on Apple platforms (GitHub Advisory, Fix PR).

The primary impact is availability: long-running applications such as servers, daemons, or monitoring tools that periodically call thread_amount will progressively exhaust system resources. On Windows, handle exhaustion eventually causes process termination when the OS handle limit is reached; on macOS/iOS, the OOM killer terminates the process once memory is depleted. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data, and lateral movement is not applicable (GitHub Advisory).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.04%, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an attacker be able to trigger repeated calls to the thread_amount function in an application using the vulnerable crate, which may be possible remotely if the function is invoked in response to network requests (GitHub Advisory, Feedly).

Upgrade the thread-amount crate to version 0.2.2 or later, which adds proper CloseHandle calls on Windows and mach_vm_deallocate calls on Apple platforms. In Cargo.toml, update the dependency to thread-amount = "0.2.2" or thread-amount = "0.3" (latest). As a temporary workaround, limit or throttle calls to the thread_amount function in application code, and monitor process handle counts (Windows) and memory usage (macOS) for anomalous growth (GitHub Advisory, Fix PR, RustSec Advisory).