Cloudflare Ties 155 Cross-Request Leaks to SGLang Rejection Bug
Cloudflare says 155 long-context GLM-5.3 responses leaked other users' KV cache data after a pool-size mismatch and an SGLang rejection bug; it found no evidence of deliberate exploitation.
Cloudflare disclosed that 155 responses from its GLM-5.3 Workers AI model contained data from other customers' requests between August 27 and September 9, 2026. The exposure affected only prompts longer than 681,280 tokens and followed a prefill KV pool configured smaller than the model's 1,048,576-token context window.
Cloudflare says a second flaw in SGLang's disaggregated prefill/decode mode let rejected over-length requests proceed: prefill generated a one-token placeholder and transferred one page, while decode had reserved pages for the full prompt and attended over stale pages from earlier requests. Cloudflare disabled the model, enlarged the pool to about 2.04 million tokens, patched the engine, and restored service on September 9.
It found no evidence of deliberate exploitation.
Key takeaways
- Cloudflare says the 155 affected responses all came from prompts longer than 681,280 tokens; after excluding its own testing and the researcher's, the timing and volume were consistent with ordinary long-context use, not repeated exploitation.
- The prefill KV pool held 681,280 tokens while GLM 5.3 was deployed with a 1,048,576-token context window. Cloudflare knew of the mismatch but expected the engine to return an error, and its long-context tests returned successful HTTP responses.
- In SGLang's disaggregated mode, admission queues checked whether a request was finished, not whether it was rejected; a rejected request still reported itself as live, so it was admitted. Prefill ran a one-token placeholder and transferred only its page, while decode had already reserved pages for the full prompt and read stale KV pages from earlier requests, returning HTTP 200 with other users' data.
- Remediation paired the pool fix with an engine patch that retires rejected requests before bootstrap, allocation, or KV transfer, proposed upstream as #38704. Related fixes landed in SGLang v0.5.20–v0.5.22, and Cloudflare recommends all operators run v0.5.22 or later.
- Cloudflare prototyped page-level tags that check KV page ownership at read time, reporting under 1% throughput and tail-latency cost in its tests, but disabled the prototype after reliability issues and because it was tied to specific attention backends and model architectures; it is now working with the SGLang team on a production version.
What people think
Analysis details
7 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. Selected themes do not measure community opinion or how common a view is.
Naming GLM-5.3 in the disclosure
The headline's model name drew a dispute over blame. One argument holds that cross-request KV cache exposure is a shared-inference bookkeeping failure, not a Z.AI model defect, and that Cloudflare should own the incident rather than name an innocent party. The response says the title identifies the affected endpoint for customers and that the report attributes the issue to a Cloudflare misconfiguration and an SGLang bug. The exchange remains unresolved.
Context window exceeded KV pool
The deployment advertised a 1,048,576-token context while the prefill KV pool held only 681,280 tokens. Cloudflare says it knew of the mismatch but expected the engine to reject prompts it could not process; long-context tests returned successful responses, so it did not treat the gap as an issue. The exchange questions whether the advertised context was misleading and shows that HTTP success did not validate output.
Broader tenant-isolation risk
The incident raised two related questions: whether other providers are aware of similar cross-request KV cache exposure, and whether this is a new class of tenant-isolation vulnerability. Neither is answered, but both frame the bug as a tenant-isolation failure in shared inference infrastructure rather than a one-off.