Cloudflare Fixes a Cross-Request KV Cache Leak in Its GLM-5.3 Model

Cloudflare published a detailed technical report on October 26, 2026 about a cross-request KV cache leak affecting GLM-5.3 (@cf/zai-org/glm-5.3), one of the models available on Workers AI. For nearly two weeks, some very long-context requests could receive text fragments from other customers’ sessions. The company laid out the full timeline and the fixes applied.

#A configuration mismatch invisible to testing

GLM-5.3 launched on August 27, 2026 with an advertised context window of 1,048,576 tokens, but the prefill KV pool only covered 681,280 tokens. Cloudflare knew the two numbers didn’t match before launch, but its internal tests returned valid HTTP 200 responses, which masked the problem.

#An SGLang bug that turned a rejection into a leak

The SGLang inference engine normally flags an oversized request as rejected and substitutes a one-token placeholder. In disaggregated mode, the admission queue only checked whether a request was finished, not whether it had been rejected. The placeholder was therefore admitted: prefill transferred a single KV page, while decode reserved eight, seven of which still held data from earlier requests.

The server returned an HTTP 200 status, as if for a normal response, when the request should have been rejected with a 400.

#Incident timeline

In total, Cloudflare counts 155 affected responses, with no evidence of deliberate exploitation beyond its own testing and the researcher’s. The KV pool has since been raised to roughly 2.04 million tokens, twice the advertised context window, so every valid request fits. The 25 minutes between reproduction and incident declaration owes a lot to tight monitoring and alert triage, a discipline that applies to any infrastructure shared across customers.

#What self-hosted SGLang operators should check

Beyond Workers AI, the alert matters to any team running SGLang in disaggregated mode for its own inference service. Cloudflare recommends comparing the KV pool size against the advertised context length at startup and after every configuration change, the same discipline already urged after the Node.js Brotli decoder RCE flaw earlier in October: verify the real production configuration, not just the documented default.

# Compare the KV pool declared at startup with the model's context length
grep -i "kv_pool\|context_length" sglang_server.log | tail -n 20

# Upgrade to a patched release (admission fix included)
pip install "sglang>=0.5.22"

# Enable the recommended safeguards in disaggregated mode
python -m sglang.launch_server \
  --disaggregation-mode decode \
  --disaggregation-enable-kv-checksum \
  --kv-canary

#Key takeaway

The incident wasn’t caused by an injection or an active bypass, but by a mismatched configuration meeting an admission bug that stayed silent for months in SGLang, a reminder that shared inference infrastructure is now its own layer in agentic architectures. The fix has been live since September 9, 2026; the October 26 report mainly serves to warn independent SGLang operators who may not have tracked the upstream patches.

Further reading: Cloudflare’s full report is available at blog.cloudflare.com.