# Cloudflare details cross-request KV cache exposure in GLM-5.3 and its remediation [Canonical reading](https://escapemeridian.com/readings/cloudflare-details-cross-request-kv-cache-exposure-in-glm-5-3-ddf6cd38) Cloudflare reports that a configuration mismatch and an SGLang bug allowed some GLM-5.3 Workers AI responses to include data from other customers’ requests. The company says the exposure affected 155 responses between August 27 and September 9, 2026, all to prompts longer than 681,280 tokens. Cloudflare explains that the model’s context window exceeded the KV cache pool available on prefill GPUs. When SGLang rejected an over-length prompt, disaggregated prefill/decode processing still passed a placeholder cache to a decode node. The node treated the transfer as complete and could read stale cache pages left by earlier requests. Cloudflare says it expanded the pool, patched the rejection path, and restored the model on September 9, 2026. It also reports testing the changes against the researcher’s reproduction script and its own canary-marker tests. The company recommends operators using disaggregated SGLang compare KV pool size with context length and use a build containing the relevant fixes. Cloudflare says it found no evidence of deliberate exploitation, but this is its account of the investigation. Its longer-term proposal is to check page ownership at read time; the described prototype was disabled after reliability issues. How broadly can such checks work across model architectures without introducing reliability or performance costs? Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Cloudflare Blog · Article Original source date: Oct 26, 2026 (2026-10-26T22:01:23.889Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-06T02:02:36.928Z. First observed: 2026-10-26T22:11:02.530Z. Retrieved: 2026-10-29T16:34:35.095Z. - [Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Limits The account is Cloudflare's report; this evidence does not independently verify the investigation or its findings. Cloudflare reports a small number of affected customers but does not identify them or detail the contents of every affected response. Cloudflare says its prototype was disabled due to reliability issues and that a production version across model architectures is still in development. ## Open question How broadly can KV page-ownership checks work across model architectures without introducing reliability or performance costs? ## Source-stated Cloudflare says the exposure affected 155 responses, all to prompts longer than 681,280 tokens, between August 27 and September 9, 2026. > In total, 155 responses were affected, all to prompts longer than 681,280 tokens. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare attributes the exposure to a mismatch between the model context length and KV cache pool, combined with an SGLang rejection-path bug in disaggregated prefill/decode mode. > This specific report of cross-request KV cache exposure was the result of two overlapping issues. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says the decode node could read stale cache pages because it treated a transfer of a placeholder prompt's KV cache as complete. > The decode node subsequently generated a response while attending over stale cache pages that still held data from earlier requests. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says it expanded the pool, patched the engine, and validated the changes before restoring the model. > We validated both changes against the researcher's reproduction script and our own canary-marker tests before restoring the model. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare reports finding no evidence of deliberate exploitation. > We found no evidence of deliberate exploitation. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says its prototype for checking KV page ownership at read time was disabled after reliability issues, and it is working toward a production version across models. > We tested it on GLM 5.2 in mid-August, but disabled it shortly afterwards due to reliability issues. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5X2P2KSNBX6J13E3B4219PW.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Context window How much text a model can take in and consider at one time. - [Definition reference](https://developers.google.com/machine-learning/glossary#context-window) ## Graphics processing unit A chip that performs many calculations at once; the main hardware used to train and run AI models. - [Definition reference](https://en.wikipedia.org/wiki/Graphics_processing_unit) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: efb8f4af-7335-44d1-8890-758a88fd837f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-06T02:02:36.928Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 3fd813689f55a0aa8fd8a864e2b16004c5298e7b93934b9e0dc89fb9364288ac. Source text hash: e6a3129bcac48b1dfcd4a23991dc558440b40a73950cabaa95789f96b0fb4700. ## Revision and source-check history ### Version 1 — 2026-11-06T02:02:36.928Z Cloudflare reports that a configuration mismatch and an SGLang bug allowed some GLM-5.3 Workers AI responses to include data from other customers’ requests. The company says the exposure affected 155 responses between August 27 and September 9, 2026, all to prompts longer than 681,280 tokens. Cloudflare explains that the model’s context window exceeded the KV cache pool available on prefill GPUs. When SGLang rejected an over-length prompt, disaggregated prefill/decode processing still passed a placeholder cache to a decode node. The node treated the transfer as complete and could read stale cache pages left by earlier requests. Cloudflare says it expanded the pool, patched the rejection path, and restored the model on September 9, 2026. It also reports testing the changes against the researcher’s reproduction script and its own canary-marker tests. The company recommends operators using disaggregated SGLang compare KV pool size with context length and use a build containing the relevant fixes. Cloudflare says it found no evidence of deliberate exploitation, but this is its account of the investigation. Its longer-term proposal is to check page ownership at read time; the described prototype was disabled after reliability issues. How broadly can such checks work across model architectures without introducing reliability or performance costs? ## Original source Cloudflare Blog · Article Original source date: Oct 26, 2026 (2026-10-26T22:01:23.889Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-06T02:02:36.928Z. First observed: 2026-10-26T22:11:02.530Z. Retrieved: 2026-10-29T16:34:35.095Z. - [Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Limits The account is Cloudflare's report; this evidence does not independently verify the investigation or its findings. Cloudflare reports a small number of affected customers but does not identify them or detail the contents of every affected response. Cloudflare says its prototype was disabled due to reliability issues and that a production version across model architectures is still in development. ## Open question How broadly can KV page-ownership checks work across model architectures without introducing reliability or performance costs? ## Source-stated Cloudflare says the exposure affected 155 responses, all to prompts longer than 681,280 tokens, between August 27 and September 9, 2026. > In total, 155 responses were affected, all to prompts longer than 681,280 tokens. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare attributes the exposure to a mismatch between the model context length and KV cache pool, combined with an SGLang rejection-path bug in disaggregated prefill/decode mode. > This specific report of cross-request KV cache exposure was the result of two overlapping issues. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says the decode node could read stale cache pages because it treated a transfer of a placeholder prompt's KV cache as complete. > The decode node subsequently generated a response while attending over stale cache pages that still held data from earlier requests. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says it expanded the pool, patched the engine, and validated the changes before restoring the model. > We validated both changes against the researcher's reproduction script and our own canary-marker tests before restoring the model. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare reports finding no evidence of deliberate exploitation. > We found no evidence of deliberate exploitation. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source-stated Cloudflare says its prototype for checking KV page ownership at read time was disabled after reliability issues, and it is working toward a production version across models. > We tested it on GLM 5.2 in mid-August, but disabled it shortly afterwards due to reliability issues. - [Supporting source](https://blog.cloudflare.com/kv-cache-exposure-remediation/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5X2P2KSNBX6J13E3B4219PW.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Context window How much text a model can take in and consider at one time. - [Definition reference](https://developers.google.com/machine-learning/glossary#context-window) ## Graphics processing unit A chip that performs many calculations at once; the main hardware used to train and run AI models. - [Definition reference](https://en.wikipedia.org/wiki/Graphics_processing_unit) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: efb8f4af-7335-44d1-8890-758a88fd837f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-06T02:02:36.928Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 3fd813689f55a0aa8fd8a864e2b16004c5298e7b93934b9e0dc89fb9364288ac. Source text hash: e6a3129bcac48b1dfcd4a23991dc558440b40a73950cabaa95789f96b0fb4700. ### passed — 2026-11-06T02:02:36.928Z — anthropic/claude-opus-5.5 Publication: efb8f4af-7335-44d1-8890-758a88fd837f attribution — pass: The draft consistently attributes the incident account, cause, remediation, no-exploitation finding and recommendations to Cloudflare. It also notes that this is the company's own account, which matches the publisher-page source. > Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure. summary — pass: The draft accurately leads with what happened: other customers' data appeared in 155 responses. It then explains the two causes, the fix, the advice to operators and the longer-term idea. Technical terms such as KV cache and prefill/decode are kept exactly for tooltips. The draft also notes that SGLang is software other operators use. The title and question follow from the evidence and are not leading. > As a result, responses to prompts longer than 681,280 tokens could contain data from other users' GLM 5.3 sessions. date — pass: originalPublished is 2026-10-26, which matches the source's statement that the report was published in coordination with the researcher and RadixArk on Oct 26, 2026. The incident dates in the draft (Aug 27 to Sep 9, restored Sep 9) also match the source. > Oct 26, 2026 Coordinated publication with the researcher and RadixArk. support — pass: Each claim is source-stated with matching excerpts. These include the 155 affected responses, the two overlapping causes, stale pages being read, validation before restoring the model, no evidence of exploitation, and the prototype being disabled. The question about cost and reliability across model architectures follows from the source's prototype limits. The draft adds no unsupported claims about benefits or harms. > The prototype was also tied to specific attention backends and model architectures, so it could not be a general fix. media — pass: The selected media is the verified direct link to the original Cloudflare article. This is the most direct way for readers to reach the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/ddf6cd38671b8e65acc068399410cec22dff1e2dc19a40b7dad1c0ede26828a7/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/cloudflare-details-cross-request-kv-cache-exposure-in-glm-5-3-ddf6cd38.json)