🔍 Read the full analysis: What Cloudflare’s KV Cache Leak Means For AI Session Privacy on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The problem involved a configuration mismatch and an SGLang inference-engine bug; Cloudflare says it took the model offline, deployed a fix and found no evidence of deliberate exploitation. The report does not explain how affected customers were notified.
The issue affected prompts longer than 681,280 tokens, according to Cloudflare. A security researcher reported the behavior through the company’s HackerOne program on September 8. Cloudflare began verifying the report the next morning, declared an incident at 13:22 UTC and took the model offline 38 minutes later. It says it restored a fixed version that evening.
Cloudflare had configured a 1,048,576-token context window, but the memory pool used to hold a prompt’s intermediate model data—the key-value, or KV, cache—could hold only 681,280 tokens. When a prompt exceeded that capacity, SGLang marked it as rejected and replaced it with a one-token placeholder. In Cloudflare’s split prefill-and-decode setup, queues checked whether requests had finished but did not check whether they had been rejected.
As a result, the decode stage could read memory pages reserved for the full prompt even though the prefill stage had written only the placeholder. Cloudflare’s report says some of those unread pages still held other customers’ prompts and partial generations. The report says the affected responses were consistent in timing and volume with ordinary long-context use, rather than repeated attempts to exploit the bug. It does not identify the customers or describe the content exposed.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how an AI service can expose customer data through the infrastructure that handles model requests, even when the model itself is not the source of the flaw. A shared GPU memory pool depends on accurate request tracking and isolation: if a rejected request is treated as active, data left in cache pages can cross session boundaries.
For users, the central concern is that a response may contain material from another customer’s interaction without making the cause obvious. Cloudflare says responses could appear coherent, and the client received an HTTP 200 response rather than an error. That makes output checking alone an unreliable way to identify exposure. The report says speed was the only apparent signal described: affected replies arrived faster than expected.
The findings also matter to providers that use long-context models and split inference systems. Cloudflare says it tested response codes and performance at long context lengths but did not validate model output and coherence. That admission points to a gap between testing whether a service responds and testing whether its response is isolated and correct.
Products Worth Considering
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
The Configuration and SGLang Failure
A KV cache stores intermediate calculations made as a model processes a prompt, so the model does not have to recalculate them for every generated token. Inference systems divide GPU memory into fixed-size pages that requests borrow and later release. Cloudflare says those pages are not zeroed between requests; a later request is expected to overwrite them. Under normal operation, the engine’s bookkeeping prevents one request from reading another’s pages.
Cloudflare ran GLM-5.3 in a disaggregated configuration: one group of GPUs processed prompts and built caches, while another generated responses. The context-window and memory-pool mismatch was the service-side fault. The SGLang bug allowed rejected requests to pass through the separate queues because those queues checked completion status, not rejection status.
Cloudflare says the SGLang issue had previously been reported to the project on July 6, 2026, as issue #30233; the company says it noticed that report during its own investigation. Cloudflare also acknowledged that its long-context tests checked HTTP responses and engine performance, without checking generated output for coherence.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare’s incident report
Customer Notifications and Exposure Scope
Cloudflare’s published account gives a count of 155 affected responses, but does not state how many customers or distinct sessions were involved, what kinds of information appeared in the responses, or whether any exposed material was retained or acted on by recipients. It also does not say how affected customers were notified.
The company says it found no evidence of deliberate exploitation, but that assessment does not establish whether every affected response was seen or recognized by its recipient. The report describes the timing and volume as consistent with ordinary use; it does not provide customer-level details that would allow readers to independently assess the impact.
The available source material does not specify whether the SGLang project has released a fix for issue #30233, whether other services using the affected code path were at risk, or what additional safeguards Cloudflare has added beyond restoring a fixed model version.
Follow-Up on Fixes and Customer Notice
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of September 9, after taking the model offline during the incident. Its published report is the clearest account so far of the cause and response, but further information would be needed to establish the customer impact and notification process.
Key follow-up questions include whether Cloudflare will publish details on affected customers and the types of data in the responses, and whether it has changed long-context testing to verify output isolation as well as service performance. Updates from the SGLang project on the previously filed bug could also clarify whether the underlying inference-engine issue has been corrected for other deployments.
Key Questions
What leaked through Cloudflare’s GLM-5.3 service?
Cloudflare says 155 responses contained data from other customers’ requests. Its report refers to prompts and partial generations in reused KV-cache memory, but does not identify the specific customers or content.
Who could have been affected?
The reported responses were triggered by prompts longer than 681,280 tokens sent to the hosted GLM-5.3 endpoint during the incident period, August 27 to September 9, 2026. Cloudflare has not said how many distinct customers or sessions were involved.
Was the leak deliberately exploited?
Cloudflare says it found no evidence of deliberate exploitation. Its report says the requests’ timing and volume were consistent with ordinary long-context use, but it does not provide customer-level records for independent review.
What caused the cross-session exposure?
Cloudflare attributes it to two faults: a mismatch between the advertised context window and available KV-cache memory, and an SGLang bug that allowed rejected requests through queues in the split inference setup.
What did Cloudflare do after the report?
After a researcher reported the issue on September 8, Cloudflare investigated, took the model offline 38 minutes after declaring an incident and says it restored a fixed version that evening on September 9. The published account does not say how customers were notified.
Source: ThorstenMeyerAI.com
