{
  "id": 20205846,
  "title": "Cross‑Request KV Cache Exposure in GLM‑5.3 Workers AI: A Deep Dive and SGLang Remediation",
  "url": "https://urgent.news/2026/11/15/cross-request-kv-cache-exposure-in-glm-5-3-workers-ai-a-deep-dive-and",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-15T18:01:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mubashir_arham/cross-request-kv-cache-exposure-in-glm-53-workers-ai-a-deep-dive-and-sglang-remediation-2jd6"
  },
  "original_language": "en",
  "account": "This article examines a security issue discovered in Cloudflare's GLM‑5.3 model running on Workers AI. The problem stems from a misconfiguration that caused cross‑request exposure of the KV cache used for token generation.\n\nThe model architecture consists of three isolated V8 environments, each maintaining a local KV cache for attention pages. These pages are stored with composite keys including a request ID, layer number and token index. The KV cache manager in SGLang pre‑allocates buffers for each request and maps them to slots in a buffer pool.\n\nThe bug occurs when the kv_isolation configuration is set to false, causing buffers to be recycled across requests. Without a guard, buffers could be reused before the KV pages are flushed, allowing stale token embeddings to be leaked between requests.\n\nTo remediate the issue, FutureStack implemented three key changes:\n1) Embedding the request ID in all KV keys to enforce request‑scoped isolation\n2) Introducing a generation fence counter that invalidates slots older than the current request\n3) Setting a minimum TTL of 30 seconds for KV pages to guarantee eventual consistency before reuse.\n\nThe remediation code demonstrates how to safely write and read KV pages with the corrected key schema and generation fence. By enforcing request‑level isolation in KV keys and adding defensive mechanisms, the cross‑request exposure is mitigated and the system remains performant.",
  "summary": "This article was originally published on FutureStack Introduction When a high‑throughput inference service leaks state between independent client calls, the breach is both a security risk and a performance nightmare. In late 2024 Cloudflare disclosed a cross‑request KV cache exposure in the GLM‑5.3 model running on Workers AI. The root cause was a subtle configuration mismatch that triggered a…",
  "key_points": [
    "Cross-request KV cache exposure in GLM-5.3 Workers AI due to misconfiguration.",
    "Remediation includes request ID embedding, generation fence counter, and 30-second TTL for KV pages."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}