CVE-2025-65947 thread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS
Repeated calls to thread-amount leak resources on Windows and macOS, causing process termination due to handle or memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65947?
CVE-2025-65947 is a high-severity denial of service vulnerability in jzeuzs thread-amount, published on 21 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on Windows and Apple platforms. In Windows platforms, the thread_amount function calls CreateToolhelp32Snapshot but fails to close the returned HANDLE using CloseHandle. Repeated calls to this function will cause the handle count of the process to grow indefinitely, eventually leading to system instability or process termination when the handle limit is reached. In Apple platforms, the thread_amount function calls task_threads (via Mach kernel APIs) which allocates memory for the thread list. The function fails to deallocate this memory using vm_deallocate. Repeated calls will result in a steady memory leak, eventually causing the process to be killed by the OOM (Out of Memory) killer. This issue has been patched in version 0.2.2.
Which versions are affected by CVE-2025-65947?
3 open source packages ship an affected version, including thread-amount.
| Package | Affected | Fixed in |
|---|---|---|
thread-amount crates.io | All versions | 0.2.2 |
thread-amount crates.io | All versions | 0.2.2 |
thread-amount crates.io | From 0.0.0-0 | 0.2.2 |
How do I fix CVE-2025-65947?
Upgrade thread-amount to 0.2.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-65947 being exploited?
There is no known exploitation of CVE-2025-65947 in the wild and no public exploit code.
Sources
Also known as GHSA-jf9p-2fv9-2jp2, RUSTSEC-2025-0125.