1 source 19m ago
Cloudflare Details GLM-5.3 KV Cache Leak And Its SGLang Fix
Cloudflare published its explanation on October 26 of a cross-request KV cache leak in the GLM-5.3 model on Workers AI. Between August 27 and September 9, 155 responses to prompts above 681,280 tokens carried data from other customers' requests.
Reporting from 1 source: GIGAZINE.
Why it matters
The leak surfaced only in the long-context range where the prefill cache could not hold the prompt, which made a serving-capacity mismatch, not an attack, the thing to fix.
Key Facts
- Cloudflare published its explanation of the GLM-5.3 Workers AI KV cache exposure on October 26.
- Gadi Evron reported the tenant isolation issue through HackerOne on September 8, 2026.
- 155 responses were affected, all to prompts exceeding 681,280 tokens.
- The prefill KV cache pool held 681,280 tokens while the model's context window was 1,048,576 tokens.
- Cloudflare restored GLM-5.3 on September 9 after raising the cache pool to about 2.04 million tokens and patching SGLang.
Cloudflare traced the cause to a KV cache pool configured smaller than the model's context window and to an SGLang bug in disaggregated prefill-decode mode, then patched both.
Gadi Evron reported the tenant isolation issue through HackerOne on September 8. Cloudflare declared a security incident the next day at 13:22 and reproduced the leak within 25 minutes using two independent accounts. GLM-5.3 went private at 14:00, the root cause was identified at 14:35, and the model was restored at 19:40 after all prefill nodes were migrated to the corrected configuration and the engine patch was deployed.
The fix raised the KV cache pool to hold roughly 2.04 million tokens. On the engine side, rejected requests are now discarded, and the decode node validates the number of tokens forwarded to it.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google