· Oct 26, 2026
Cloudflare details cross-request KV cache exposure in GLM-5.3 and its remediation
Markdown · JSON · Original source
reports that a configuration mismatch and an SGLang bug allowed some GLM-5.3 Workers AI responses to include data from other customers’ requests. The company says the exposure affected 155 responses between August 27 and September 9, 2026, all to prompts longer than 681,280 tokens. Cloudflare explains that the model’s exceeded the KV cache pool available on prefill . When SGLang rejected an over-length prompt, disaggregated prefill/decode processing still passed a placeholder cache to a decode node. The node treated the transfer as complete and could read stale cache pages left by earlier requests. Cloudflare says it expanded the pool, patched the rejection path, and restored the model on September 9, 2026. It also reports testing the changes against the researcher’s reproduction script and its own canary-marker tests. The company recommends operators using disaggregated SGLang compare KV pool size with context length and use a build containing the relevant fixes. Cloudflare says it found no evidence of deliberate exploitation, but this is its account of the investigation. Its longer-term proposal is to check page ownership at read ; the described prototype was disabled after reliability issues. How broadly can such checks work across model architectures without introducing reliability or performance costs?
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
Blog · Article
Source details
Original source date: Oct 26, 2026 (2026-10-26T22:01:23.889Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-06T02:02:36.928Z. First observed: 2026-10-26T22:11:02.530Z. Retrieved: 2026-10-29T16:34:35.095Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The account is 's report; this evidence does not independently verify the investigation or its findings. Cloudflare reports a small number of affected customers but does not identify them or detail the contents of every affected response. Cloudflare says its prototype was disabled due to reliability issues and that a production version across model architectures is still in development.
Open question
How broadly can KV page-ownership checks work across model architectures without introducing reliability or performance costs?
Source-stated
Cloudflare says the exposure affected 155 responses, all to prompts longer than 681,280 tokens, between August 27 and September 9, 2026.
In total, 155 responses were affected, all to prompts longer than 681,280 tokens.
Source-stated
Cloudflare attributes the exposure to a mismatch between the model context length and KV cache pool, combined with an SGLang rejection-path bug in disaggregated prefill/decode mode.
This specific report of cross-request KV cache exposure was the result of two overlapping issues.
Source-stated
Cloudflare says the decode node could read stale cache pages because it treated a transfer of a placeholder prompt's KV cache as complete.
The decode node subsequently generated a response while attending over stale cache pages that still held data from earlier requests.
Source-stated
Cloudflare says it expanded the pool, patched the engine, and validated the changes before restoring the model.
We validated both changes against the researcher's reproduction script and our own canary-marker tests before restoring the model.
Source-stated
Cloudflare reports finding no evidence of deliberate exploitation.
We found no evidence of deliberate exploitation.
Source-stated
Cloudflare says its prototype for checking KV page ownership at read time was disabled after reliability issues, and it is working toward a production version across models.
We tested it on GLM 5.2 in mid-August, but disabled it shortly afterwards due to reliability issues.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Context window
How much text a model can take in and consider at one time.
Graphics processing unit
A chip that performs many calculations at once; the main hardware used to train and run AI models.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
TIME
TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Editorial provenance
Version 1. Publication ID: efb8f4af-7335-44d1-8890-758a88fd837f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-06T02:02:36.928Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 3fd813689f55a0aa8fd8a864e2b16004c5298e7b93934b9e0dc89fb9364288ac. Source text hash: e6a3129bcac48b1dfcd4a23991dc558440b40a73950cabaa95789f96b0fb4700.
Revision and source-check history
Version 1 · 2026-11-06T02:02:36.928Z
Cloudflare details cross-request KV cache exposure in GLM-5.3 and its remediation
reports that a configuration mismatch and an SGLang bug allowed some GLM-5.3 Workers AI responses to include data from other customers’ requests. The company says the exposure affected 155 responses between August 27 and September 9, 2026, all to prompts longer than 681,280 tokens. Cloudflare explains that the model’s exceeded the KV cache pool available on prefill . When SGLang rejected an over-length prompt, disaggregated prefill/decode processing still passed a placeholder cache to a decode node. The node treated the transfer as complete and could read stale cache pages left by earlier requests. Cloudflare says it expanded the pool, patched the rejection path, and restored the model on September 9, 2026. It also reports testing the changes against the researcher’s reproduction script and its own canary-marker tests. The company recommends operators using disaggregated SGLang compare KV pool size with context length and use a build containing the relevant fixes. Cloudflare says it found no evidence of deliberate exploitation, but this is its account of the investigation. Its longer-term proposal is to check page ownership at read ; the described prototype was disabled after reliability issues. How broadly can such checks work across model architectures without introducing reliability or performance costs?
Original source
Blog · Article
Source details
Original source date: Oct 26, 2026 (2026-10-26T22:01:23.889Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-06T02:02:36.928Z. First observed: 2026-10-26T22:11:02.530Z. Retrieved: 2026-10-29T16:34:35.095Z.
Limits
The account is 's report; this evidence does not independently verify the investigation or its findings. Cloudflare reports a small number of affected customers but does not identify them or detail the contents of every affected response. Cloudflare says its prototype was disabled due to reliability issues and that a production version across model architectures is still in development.
Open question
How broadly can KV page-ownership checks work across model architectures without introducing reliability or performance costs?
Source-stated
Cloudflare says the exposure affected 155 responses, all to prompts longer than 681,280 tokens, between August 27 and September 9, 2026.
In total, 155 responses were affected, all to prompts longer than 681,280 tokens.
Source-stated
Cloudflare attributes the exposure to a mismatch between the model context length and KV cache pool, combined with an SGLang rejection-path bug in disaggregated prefill/decode mode.
This specific report of cross-request KV cache exposure was the result of two overlapping issues.
Source-stated
Cloudflare says the decode node could read stale cache pages because it treated a transfer of a placeholder prompt's KV cache as complete.
The decode node subsequently generated a response while attending over stale cache pages that still held data from earlier requests.
Source-stated
Cloudflare says it expanded the pool, patched the engine, and validated the changes before restoring the model.
We validated both changes against the researcher's reproduction script and our own canary-marker tests before restoring the model.
Source-stated
Cloudflare reports finding no evidence of deliberate exploitation.
We found no evidence of deliberate exploitation.
Source-stated
Cloudflare says its prototype for checking KV page ownership at read time was disabled after reliability issues, and it is working toward a production version across models.
We tested it on GLM 5.2 in mid-August, but disabled it shortly afterwards due to reliability issues.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Context window
How much text a model can take in and consider at one time.
Graphics processing unit
A chip that performs many calculations at once; the main hardware used to train and run AI models.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
TIME
TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Editorial provenance
Version 1. Publication ID: efb8f4af-7335-44d1-8890-758a88fd837f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-06T02:02:36.928Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 3fd813689f55a0aa8fd8a864e2b16004c5298e7b93934b9e0dc89fb9364288ac. Source text hash: e6a3129bcac48b1dfcd4a23991dc558440b40a73950cabaa95789f96b0fb4700.
passed · 2026-11-06T02:02:36.928Z · anthropic/claude-opus-5.5
Publication: efb8f4af-7335-44d1-8890-758a88fd837f
attribution — pass: The draft consistently attributes the incident account, cause, remediation, no-exploitation finding and recommendations to Cloudflare. It also notes that this is the company's own account, which matches the publisher-page source.
Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure.
summary — pass: The draft accurately leads with what happened: other customers' data appeared in 155 responses. It then explains the two causes, the fix, the advice to operators and the longer-term idea. Technical terms such as KV cache and prefill/decode are kept exactly for tooltips. The draft also notes that SGLang is software other operators use. The title and question follow from the evidence and are not leading.
As a result, responses to prompts longer than 681,280 tokens could contain data from other users' GLM 5.3 sessions.
date — pass: originalPublished is 2026-10-26, which matches the source's statement that the report was published in coordination with the researcher and RadixArk on Oct 26, 2026. The incident dates in the draft (Aug 27 to Sep 9, restored Sep 9) also match the source.
Oct 26, 2026 Coordinated publication with the researcher and RadixArk.
support — pass: Each claim is source-stated with matching excerpts. These include the 155 affected responses, the two overlapping causes, stale pages being read, validation before restoring the model, no evidence of exploitation, and the prototype being disabled. The question about cost and reliability across model architectures follows from the source's prototype limits. The draft adds no unsupported claims about benefits or harms.
The prototype was also tied to specific attention backends and model architectures, so it could not be a general fix.
media — pass: The selected media is the verified direct link to the original Cloudflare article. This is the most direct way for readers to reach the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Cloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareHow much text a model can take in and consider at one time.
Definition referenceA chip that performs many calculations at once; the main hardware used to train and run AI models.
Definition referenceTIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIMECloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareHow much text a model can take in and consider at one time.
Definition referenceA chip that performs many calculations at once; the main hardware used to train and run AI models.
Definition referenceTIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIMECloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore Cloudflare