# Cloudflare’s GLM-5.3 cache leak crossed a request boundary after an internal rejection

> 155 GLM-5.3 responses exposed other customers’ material.

By BIGCHANGE.AI Editorial

Published: 2026-10-27T11:27:32.514Z
Updated: 2026-10-27T11:27:32.514Z
Canonical: https://bigchange.ai/blog/cloudflare-glm-5-3-kv-cache-cross-request-exposure

![An open generic server chassis shows a compute board, heat sink and rows of small memory packages.](https://bigchange.ai/api/media/file/cloudflare-glm-cache-hardware-hero-v2.png)
AI-generated conceptual illustration by BIG CHANGE.

Cloudflare’s [26 October disclosure](https://blog.cloudflare.com/kv-cache-exposure-remediation/) says 155 GLM-5.3 Workers AI responses contained other customers’ material from 27 August to 9 September 2026. The count is responses, not customers. Its investigation found no other Workers AI model affected and no evidence of deliberate exploitation.

## The big change

- **What changed:** Cloudflare patched its GLM-5.3 deployment.
- **Why it matters:** A reply could expose another customer’s data when cache pages held an earlier request’s state.
- **What to watch:** Compare cache capacity with the input limit.

## Context exceeded cache capacity

The stated context was 1,048,576 tokens; the prefill pool held 681,280. Cloudflare’s prelaunch checks validated HTTP codes and performance, not output coherence.

The key-value, or KV, cache holds working state that the model later reads while generating an answer. [Mooncake’s SGLang integration guide](https://github.com/kvcache-ai/mooncake/blob/main/docs/source/deployment/integrations/sglang/pd-disaggregation.md) documents how prompt processing (**prefill**) transfers KV blocks to a separate worker that generates the answer (**decode**). Decode must read only written pages.

## How the rejected prompt reached decode

Over-pool prompts queued rejection with a one-token placeholder. Single-node serving returned an error. Disaggregated admission checked *finished* status instead of the pending error, so handoff continued.

Decode reserved original pages, but prefill delivered only the placeholder’s page. Decode read unwritten pages holding earlier state; another request’s material reached the answer. The [admission fix](https://github.com/sgl-project/sglang/pull/38935) rejects before reservation.

## Capacity and rejection fixes

On 9 September Cloudflare restricted GLM-5.3, expanded the pool to about 2.04 million tokens and patched the engine before restoring access. Rejection handling remains essential.

[Pull request 36988](https://github.com/sgl-project/sglang/pull/36988), merged 6 September but unreleased then, already prevented wrong-status and stale-KV output by retiring aborted prefill after its in-flight result. [Pull request 38935](https://github.com/sgl-project/sglang/pull/38935), merged 16 September, moved rejection to admission to avoid wasted work and delay.

Cloudflare [recommends v0.5.22 or later](https://blog.cloudflare.com/kv-cache-exposure-remediation/) for disaggregated SGLang operators. The [release](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) is dated 19 October. SGLang’s [security update](https://www.lmsys.org/blog/2026-10-26-cf-security) has backend-specific guidance.

## A separate abort race and the limit of its safeguard

An abort can cause a different cache ownership failure. Decode may reuse a request’s destination pages while a remote write remains in flight. The late write then changes the next request’s cache. [SGLang’s deferred-release change](https://github.com/sgl-project/sglang/pull/35049) holds pages while transfers drain; a [follow-up](https://github.com/sgl-project/sglang/pull/41404) covers other transfer failures. This race differs from the placeholder rejection path.

The hold ends after drain acknowledgements or a timeout. Acknowledgement confirms launched writes finished; **timeout alone does not**. Safe reuse after timeout depends on every outstanding write ending during the hold. An [optional transfer checksum](https://github.com/sgl-project/sglang/pull/39500) can catch corruption before decode on supported models.

## Sources

- [Cloudflare, KV cache exposure disclosure](https://blog.cloudflare.com/kv-cache-exposure-remediation/) — Operator account of scope and repair.
- [SGLang, request-isolation security update](https://www.lmsys.org/blog/2026-10-26-cf-security) — Engineering account of rejection and the separate abort race.
- [SGLang PR 36988, aborted prefill retirement](https://github.com/sgl-project/sglang/pull/36988) — Merged 6 September; prevented stale output before admission cleanup.
- [SGLang PR 38935, early rejection](https://github.com/sgl-project/sglang/pull/38935) — Merged 16 September; avoids unnecessary handoff.
- [SGLang release v0.5.22 (19 October 2026)](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) — Official release record confirms the 19 October version date.
- [SGLang pull request 35049, deferred decode-side KV release](https://github.com/sgl-project/sglang/pull/35049) — Holds decode pages until transfer drain acknowledgement or timeout; timeout alone cannot prove drain.
- [SGLang pull request 41404, hold cache pages on every transfer failure](https://github.com/sgl-project/sglang/pull/41404) — Extends page holds to other transfer failures.
- [SGLang pull request 39500, optional KV transfer checksums](https://github.com/sgl-project/sglang/pull/39500) — Optional transfer checksum; model support varies.
- [Mooncake documentation, SGLang disaggregated serving with Mooncake Transfer Engine](https://github.com/kvcache-ai/mooncake/blob/main/docs/source/deployment/integrations/sglang/pd-disaggregation.md) — Documents the generic prefill-to-decode transfer; not Cloudflare deployment evidence.