Cloudflare disclosed cross-request KV cache exposure in Workers AI’s GLM-5.3 on October 26, 2026, in a coordinated publication with the researcher and SGLang maintainers. Cloudflare says only GLM-5.3 was affected: 155 responses contained other customers’ data, all answering prompts longer than 681,280 tokens. It found no evidence of deliberate exploitation.[1]
Two failures combined. Cloudflare configured a 1,048,576-token context window, but its prefill GPUs’ KV cache pool held only 681,280 tokens. In SGLang’s disaggregated prefill/decode pipeline, an oversized request was marked rejected and replaced with a one-token stub, yet still reported itself as live. Prefill processed the stub and signaled transfer completion; decode assumed the full prompt’s cache had arrived and read stale pages containing earlier requests’ data.[1]
The exposure began with the model’s August 27, 2026 launch. Knostic’s Gadi Evron reported it through HackerOne on September 8. Cloudflare declared an incident on September 9 at 13:22 UTC and restored the model at 19:40 UTC that day.[1]
SGLang merged #36988 on September 6, 2026, adding cleanup for aborted prefill results; Cloudflare identifies it as the fix that stops this exposure.[1][3] PR #38935 merged September 16 to reject requests earlier at admission. Its description explicitly calls this a waste-and-latency improvement, rather than an additional correctness fix after #36988.[4]
Cloudflare expanded the pool to about 2.04 million tokens and patched rejection handling before restoring service. It recommends SGLang v0.5.22 or later, pool-capacity checks, deferred KV release and bounded transfers. It also recommends transfer checksums and KV canaries where supported, while noting incomplete architecture coverage, including GLM-5.3. Broader support and checks at every decode step remain work in progress.[1]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
80920ca7b52b4e6099fcdc3a55221a0220c46bf357365ba95a63855200fc788f
