{"id":"RUSTSEC-2025-0125","revision":"20ba293f05cb4cb390f762c7a7066339","records":[{"revision":"20ba293f05cb4cb390f762c7a7066339","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0125","aliases":["CVE-2025-65947","GHSA-jf9p-2fv9-2jp2"],"title":"Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS","description":"Affected versions of this crate contain resource leaks when querying thread counts on Windows and Apple platforms.\n\n### Windows\nThe `thread_amount` function calls `CreateToolhelp32Snapshot` but fails to close the returned `HANDLE` using `CloseHandle`. Repeated calls to this function will cause the handle count of the process to grow indefinitely, eventually leading to system instability or process termination when the handle limit is reached.\n\n### macOS / iOS\nThe `thread_amount` function calls `task_threads` (via Mach kernel APIs) which allocates memory for the thread list. The function fails to deallocate this memory using `vm_deallocate`. Repeated calls will result in a steady memory leak, eventually causing the process to be killed by the OOM (Out of Memory) killer.\n\n### Impact\nLong-running applications (such as servers, daemons, or monitoring tools) that use this crate to periodically check thread counts will eventually crash due to resource exhaustion.\n\n### Mitigation\nUpgrade to version `0.2.2` or later, which properly releases OS resources.","state":0,"publishedAt":"2025-11-22T12:00:00+00:00","modifiedAt":"2025-11-22T12:29:36+00:00","affected":[{"ecosystem":"crates.io","name":"thread-amount","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.2.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/thread-amount","https://rustsec.org/advisories/RUSTSEC-2025-0125.html","https://github.com/jzeuzs/thread-amount/pull/29"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0125","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0125","identifiers":["RUSTSEC-2025-0125","CVE-2025-65947","GHSA-jf9p-2fv9-2jp2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}