The Exposure Window Appears in Only One of the Two Reports
Cloudflare and the SGLang maintainers published coordinated reports on the same cross-request KV cache leak. Both are candid; the blast radius is in one and the twenty-month exposure window is in the other.