Disclosed weakness · no CVE recorded

SGLang rejected-prefill handoff exposes stale KV-cache data

SGLang / Cloudflare · SGLang disaggregated prefill/decode; Workers AI GLM-5.3

First documented disclosure · Review checkpoint

Summary

Rejected long prompts could enter decode with incomplete cache data and return content from previous requests.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Customer data mixing occurred; Cloudflare found no evidence of deliberate exploitation. Accidental exposure does not establish malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A rejected request became a one-token placeholder but still reached the disaggregated handoff; decode read reserved pages that this request had not overwritten.

Conditions required

Disaggregated prefill/decode serving with a prompt longer than the prefill KV pool but within the configured context window. The single-node rejection path is not affected by this specific flaw.

Potential impact

Cross-request content disclosure; Cloudflare confirmed 155 affected responses in its GLM-5.3 deployment.

Affected versions and configurations

The July report reproduced SGLang 0.5.11. A complete starting-version range for this admission flaw is not established. Cloudflare GLM-5.3 was exposed August 27–September 9, 2026.

Fix and mitigation status

SGLang 0.5.20 includes the incident fix (#36988); 0.5.21 adds earlier admission rejection (#38935). Cloudflare recommends 0.5.22 or later for related hardening. Hosted GLM-5.3 remediation completed September 9.

Practical next steps

Update SGLang and verify actual KV-pool capacity against context length on every serving role; retain rejection and cache-lifetime protections.

Operating lesson

Validate output isolation under rejected requests, not just successful HTTP status and throughput.

Evidence and limits

Cloudflare explicitly identifies July 6 issue #30233 as this same bug. October 26 disclosed the customer impact; September 9 status reporting described errors only. Separate abort-transfer races have different version ranges and should not be conflated with this admission flaw.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources