Source: Cloudflare technical blog disclosure authored by Kevin Flansburg and Michelle Chen, published on October 26, 2026.
On September 8, 2026, security researcher Gadi Evron from Knostic submitted a vulnerability report through Cloudflare's HackerOne bug bounty program, documenting that requests sent to the GLM-5.3 Workers AI model (`@cf/zai-org/glm-5.3`) occasionally returned verbatim text belonging to queries executed by other customers. Cloudflare disabled the endpoint within hours and verified that 155 responses between August 27 and September 9 were affected.
Technical analysis revealed a systemic interaction between operational misconfiguration and upstream inference code in SGLang, the open-source high-throughput inference framework utilized by Cloudflare. Cloudflare deployed GLM-5.3 with a 1,048,576-token context window; however, the GPU prefill KV buffer was incorrectly configured with an allocation limit of only 524,288 tokens.
Under SGLang's disaggregated prefill/decode architecture, requests exceeding the prefill capacity were flagged internally as rejected and replaced with a single placeholder token. However, instead of aborting the request and returning an HTTP 400 error to the client, the system forwarded the placeholder into the decode stage. The decode workers subsequently processed the placeholder token against uninitialized GPU memory pages that retained KV-cache tensor states from preceding requests.
Cloudflare resolved the issue by adjusting GPU memory allocations to double the prefill buffer to 2.04 million tokens, matching its GLM-5.2 operational baseline. Upstream patches contributed to SGLang ensure that rejected overflow requests trigger an immediate pipeline termination, paired with mandatory zero-fill sanitization of released memory pages.
The disclosure underscores the delicate security balance required by modern high-throughput LLM serving. As multi-tenant inference providers deploy aggressive KV cache reuse, chunked prefill, and disaggregated architectures, rigorous tenant isolation audits are becoming as indispensable as network virtualization security.