Evidence File — The Leak That Returned HTTP 200
Evidence file · published with the report
Primary documents
| Document | Role | Use |
|---|---|---|
| https://blog.cloudflare.com/kv-cache-exposure-remediation/ | Primary source | Supports the article's claims |
Claim-by-claim verification
| Claim as published | Status | Basis |
|---|---|---|
| Report published 26 October 2026 by Kevin Flansburg and Michelle Chen | CONFIRMED | Report header |
| 155 responses were affected, all to prompts longer than 681,280 tokens | CONFIRMED verbatim | Company disclosure |
| Exposure window 27 August to 9 September 2026 | CONFIRMED verbatim | "Between August 27 and September 9" |
| Reported on 8 September by Gadi Evron of Knostic via HackerOne | CONFIRMED verbatim | Company disclosure |
| Context window 1,048,576 tokens against a 681,280-token pool | CONFIRMED verbatim | Company disclosure |
| Cloudflare knew of the mismatch before launch | CONFIRMED verbatim | "We were aware of this size mismatch" |
| Pre-launch testing validated response codes and engine performance but not model output | CONFIRMED verbatim | "we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence" |
| The SGLang bug had been reported by another user as issue #30233 on 6 July 2026 | CONFIRMED verbatim | Company disclosure; issue not independently retrieved for this article |
| Pages are not zeroed between requests | CONFIRMED verbatim | "Pages are not currently zeroed between requests" |
| The client received HTTP 200 rather than HTTP 400, with a coherent reply and matching prompt_tokens | CONFIRMED verbatim | Company disclosure |
| The eight-page reservation is the report's worked example | CONFIRMED | "8 pages in the diagram" - an illustration, and the article now says so |
| The pool was enlarged to roughly 2.04 million tokens, about twice the context length | CONFIRMED verbatim | Company disclosure |
| A tagged-page prototype cost under 1 percent in throughput and tail latency, and was disabled for reliability reasons | CONFIRMED verbatim | Company measurement and admission |
| The prototype could not be a general fix | CONFIRMED verbatim | "so it could not be a general fix" |
| Cloudflare had been flagging this class of issue with SGLang since v0.5.10 | CONFIRMED verbatim | A reference to the bug class, not to issue #30233; the article now says so |
| An operator-facing recommendation is to measure pool size against context length | CONFIRMED verbatim | Report's remediation guidance, quoted including the node scope and the remedy |
Known limits
- Single primary source, and that source is the subject of the article. No independent forensic examination has been published.
- No interview with Cloudflare or with the researcher who found the bug.
- Statements about severity and impact are Cloudflare's assessments and are attributed as such rather than adopted.
- The coverage measurement rests on a Hacker News query alone; the general web-search instrument returned unusable results during the drafting run, so no claim is made about mainstream coverage.
- The SGLang issue tracker was not independently retrieved. The article reports issue #30233 as Cloudflare describes it.
Provenance
Drafted from the Cloudflare report retrieved in full. Revised on 2 November 2026 after an independent review that retrieved the primary source itself: 14 corrections applied, including two blocking factual defects (an invented cache-page size used as evidence, and an unsourced nationality attribution) and a dropped qualifier that reversed an exploitation finding. Converted to this package by build-package-generic.ps1, not assembled by hand, then staged through stage-package.ps1. published, not committed, not deployed.
Produced under human editorial authority. Nothing in this file is published.