THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# Cloudflare’s GLM-5.3 cache leak crossed a request boundary after an internal rejection

> 155 GLM-5.3 responses exposed other customers’ material.

By BIGCHANGE.AI Editorial

Published: 2026-10-27T11:27:32.514Z
Updated: 2026-10-27T11:27:32.514Z
Canonical: https://bigchange.ai/blog/cloudflare-glm-5-3-kv-cache-cross-request-exposure

![An open generic server chassis shows a compute board, heat sink and rows of small memory packages.](https://bigchange.ai/api/media/file/cloudflare-glm-cache-hardware-hero-v2.png)
AI-generated conceptual illustration by BIG CHANGE.

Cloudflare’s [26 October disclosure](https://blog.cloudflare.com/kv-cache-exposure-remediation/) says 155 GLM-5.3 Workers AI responses contained other customers’ material from 27 August to 9 September 2026. The count is responses, not customers. Its investigation found no other Workers AI model affected and no evidence of deliberate exploitation.

## The big change

- **What changed:** Cloudflare patched its GLM-5.3 deployment.
- **Why it matters:** A reply could expose another customer’s data when cache pages held an earlier request’s state.
- **What to watch:** Compare cache capacity with the input limit.

## Context exceeded cache capacity

The stated context was 1,048,576 tokens; the prefill pool held 681,280. Cloudflare’s prelaunch checks validated HTTP codes and performance, not output coherence.

The key-value, or KV, cache holds working state that the model later reads while generating an answer. [Mooncake’s SGLang integration guide](https://github.com/kvcache-ai/mooncake/blob/main/docs/source/deployment/integrations/sglang/pd-disaggregation.md) documents how prompt processing (**prefill**) transfers KV blocks to a separate worker that generates the answer (**decode**). Decode must read only written pages.

## How the rejected prompt reached decode

Over-pool prompts queued rejection with a one-token placeholder. Single-node serving returned an error. Disaggregated admission checked *finished* status instead of the pending error, so handoff continued.

Decode reserved original pages, but prefill delivered only the placeholder’s page. Decode read unwritten pages holding earlier state; another request’s material reached the answer. The [admission fix](https://github.com/sgl-project/sglang/pull/38935) rejects before reservation.

## Capacity and rejection fixes

On 9 September Cloudflare restricted GLM-5.3, expanded the pool to about 2.04 million tokens and patched the engine before restoring access. Rejection handling remains essential.

[Pull request 36988](https://github.com/sgl-project/sglang/pull/36988), merged 6 September but unreleased then, already prevented wrong-status and stale-KV output by retiring aborted prefill after its in-flight result. [Pull request 38935](https://github.com/sgl-project/sglang/pull/38935), merged 16 September, moved rejection to admission to avoid wasted work and delay.

Cloudflare [recommends v0.5.22 or later](https://blog.cloudflare.com/kv-cache-exposure-remediation/) for disaggregated SGLang operators. The [release](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) is dated 19 October. SGLang’s [security update](https://www.lmsys.org/blog/2026-10-26-cf-security) has backend-specific guidance.

## A separate abort race and the limit of its safeguard

An abort can cause a different cache ownership failure. Decode may reuse a request’s destination pages while a remote write remains in flight. The late write then changes the next request’s cache. [SGLang’s deferred-release change](https://github.com/sgl-project/sglang/pull/35049) holds pages while transfers drain; a [follow-up](https://github.com/sgl-project/sglang/pull/41404) covers other transfer failures. This race differs from the placeholder rejection path.

The hold ends after drain acknowledgements or a timeout. Acknowledgement confirms launched writes finished; **timeout alone does not**. Safe reuse after timeout depends on every outstanding write ending during the hold. An [optional transfer checksum](https://github.com/sgl-project/sglang/pull/39500) can catch corruption before decode on supported models.

## Sources

- [Cloudflare, KV cache exposure disclosure](https://blog.cloudflare.com/kv-cache-exposure-remediation/) — Operator account of scope and repair.
- [SGLang, request-isolation security update](https://www.lmsys.org/blog/2026-10-26-cf-security) — Engineering account of rejection and the separate abort race.
- [SGLang PR 36988, aborted prefill retirement](https://github.com/sgl-project/sglang/pull/36988) — Merged 6 September; prevented stale output before admission cleanup.
- [SGLang PR 38935, early rejection](https://github.com/sgl-project/sglang/pull/38935) — Merged 16 September; avoids unnecessary handoff.
- [SGLang release v0.5.22 (19 October 2026)](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) — Official release record confirms the 19 October version date.
- [SGLang pull request 35049, deferred decode-side KV release](https://github.com/sgl-project/sglang/pull/35049) — Holds decode pages until transfer drain acknowledgement or timeout; timeout alone cannot prove drain.
- [SGLang pull request 41404, hold cache pages on every transfer failure](https://github.com/sgl-project/sglang/pull/41404) — Extends page holds to other transfer failures.
- [SGLang pull request 39500, optional KV transfer checksums](https://github.com/sgl-project/sglang/pull/39500) — Optional transfer checksum; model support varies.
- [Mooncake documentation, SGLang disaggregated serving with Mooncake Transfer Engine](https://github.com/kvcache-ai/mooncake/blob/main/docs/source/deployment/integrations/sglang/pd-disaggregation.md) — Documents the generic prefill-to-decode transfer; not Cloudflare deployment evidence.