CVE-2025-65947: thread-amount Package Vulnerable to Resource Exhaustion on Windows and macOS
Summary
CVE-2025-65947: thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS. Affects thread-amount versions < 0.2.2. Fixed in 0.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thread-amount package is a Rust crate designed to provide a simple and efficient way to query the number of threads in a process. It is commonly used in applications that require monitoring of system resources, such as servers and daemons. However, this package has been found to have vulnerabilities that can lead to resource exhaustion, particularly on Windows and macOS platforms.
Vulnerability Detail
The vulnerability arises from improper resource management in the thread_amount function. On Windows, the function calls CreateToolhelp32Snapshot but fails to close the returned HANDLE, leading to a handle leak. On macOS, the function calls task_threads, which allocates memory for the thread list but does not deallocate it, resulting in a memory leak. These leaks can cause long-running applications to crash due to system instability or memory exhaustion.
How To Fix
Minimum fixed version
0.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid calling the thread_amount function repeatedly in a short time frame to minimize the impact of resource leaks. Implementing a caching mechanism to store thread counts for a period can help reduce the frequency of calls.
Conclusion
The thread-amount package has a significant vulnerability that can lead to resource exhaustion on Windows and macOS platforms. It is crucial for developers using this package to update to the latest version to mitigate risks associated with this issue. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for thread-amount →
FAQ
The vulnerability affects applications running on Windows and macOS platforms.
Failure to address this vulnerability can lead to resource exhaustion, causing applications to crash or become unstable over time.
You can use Vulert, a tool that monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in version 0.2.2 of the thread-amount package. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider implementing a caching mechanism to reduce the frequency of calls to the thread_amount function as a temporary workaround.
