Cloudflare Cache Mismatch, SGLang Bug Exposed Other Users’ Data in 155 Responses

A cache-capacity mismatch and an SGLang error caused 155 Cloudflare Workers AI responses to include other customers’ prompt text and partial generated content, exposing a weakness in the model-serving setup.

Cloudflare’s Oct. 26 disclosure covers requests processed Aug. 27 to Sept. 9. All 155 affected responses came from prompts longer than 681,280 tokens. The company found no evidence of deliberate exploitation after excluding its own test requests and the reporter’s requests; the remaining traffic fit ordinary long-document use.

GLM-5.3, a model developed by Z.ai for coding agents, was available through Workers AI with a context window of about 1.05 million tokens. The GPUs processing prompts had key-value (KV) cache capacity for 681,280 tokens. A KV cache holds intermediate calculations that a model uses while processing input.

Cloudflare split prompt processing and response generation across separate GPU groups using SGLang, an open-source inference engine. For an over-capacity prompt, SGLang marked the request as rejected and replaced the input with a one-token placeholder, but did not end the request. The generation GPUs then read cache pages that still contained data from earlier requests. Those pages were not cleared between requests, a performance choice, and affected users still received normal HTTP 200 responses.

Cloudflare had identified the difference between the model’s context window and cache size before launch, but expected SGLang to return an error. Before release, it tested long prompts for HTTP status and performance, but did not check whether the generated content was correct.

Knostic researcher Gadi Evron submitted a report through HackerOne on Sept. 8. Cloudflare declared an incident at 9:22 a.m. ET (13:22 UTC) on Sept. 9. Its security team reproduced the issue with two accounts within 25 minutes and removed the model from public access at 10 a.m. ET (14:00 UTC). After adjusting the configuration and updating the engine, Cloudflare restored the model at 3:40 p.m. ET (19:40 UTC) that day. The company said no other Workers AI models were affected.

Cloudflare applied the engine fix and other safeguards to all models it serves with SGLang. It recommended that operators using the same split-GPU setup upgrade to SGLang v0.5.22 or later and compare each node’s cache capacity with its configured context length.