Cloudflare fixes GLM-5.3 cross-request KV cache leak: what are the key facts?

Between August 27 and September 9, 2026, Cloudflare's GLM-5.3 model suffered cross-request data leakage.

Cloudflare fixes GLM-5.3 cross-request KV cache leak: what are the key facts?

A total of 155 responses were affected, all originating from prompts exceeding 681,280 tokens.

Cloudflare fixes GLM-5.3 cross-request KV cache leak: what are the key facts?

Security researcher Gadi Evron reported the issue on September 8, and Cloudflare patched it and restored service the next day.

Cloudflare fixes GLM-5.3 cross-request KV cache leak: what are the key facts?

The flaw stemmed from an SGLang engine misconfiguration and a bug in handling extremely long requests.

Cloudflare fixes GLM-5.3 cross-request KV cache leak: what are the key facts?

Cloudflare adjusted its configuration to bring KV pool capacity to roughly 2.04 million tokens and patched the engine's rejection path.

Physix Frontier · News Briefing Card (enbrief · Oct 27, 2026)

Cloudflare fixes GLM-5.3 cross-request KV cache leak

KEY FACTS

Between August 27 and September 9, 2026, Cloudflare's GLM-5.3 model suffered cross-request data leakage.
A total of 155 responses were affected, all originating from prompts exceeding 681,280 tokens.
Security researcher Gadi Evron reported the issue on September 8, and Cloudflare patched it and restored service the next day.
The flaw stemmed from an SGLang engine misconfiguration and a bug in handling extremely long requests.
Cloudflare adjusted its configuration to bring KV pool capacity to roughly 2.04 million tokens and patched the engine's rejection path.

KEY DATA

155Affected responses

681,280 tokensTriggering prompt length

1,048,576 tokensModel context window

approx. 2.04 million tokensKV pool capacity after fix

PHYSIX OBSERVATION

This incident exposes the security risks in KV cache management within AI inference infrastructure, especially the boundary conditions in ultra-long-context scenarios. Cloudflare's rapid response and transparent disclosure deserve credit, but relying on a single configuration fix is not enough; hardening at the engine level is what matters. The industry should take data isolation in multi-tenant environments seriously and push for standardized security testing of inference engines.

Source: enbrief original report ↗