Cloudflare discloses GLM-5.3 Workers AI cross-request KV cache leak and completes fix

Cloudflare disclosed that the GLM-5.3 Workers AI model had a cross-request KV cache leak; from August 27 to September 9, a total of 155 responses were affected, all involving long prompts exceeding 681,280 tokens. The cause was that the prefill KV pool held only 681,280 tokens while the context window was 1,048,576 tokens; combined with a flaw in SGLang's handling of overly long requests in disaggregated prefill/decode mode, decode nodes read old cache pages that still contained other users' data. Cloudflare has expanded the prefill pool to about 2.04 million tokens and patched the engine; the relevant fixes entered SGLang v0.5.20 through v0.5.22, and operators of disaggregated deployments are advised to upgrade to v0.5.22 or later.