UpdatesAugust 28, 2026
MLSAC b55: crasher protection
A way to freeze the server through the plugin is closed, and garbage rotation angles from the client no longer reach the model.
A clean Paper 1.21.4 start with MLSAC 2.0: real console lines from our test server.
The plugin is updated to 1.0-b55. This one matters — please install it.
Crasher
Fixed a vulnerability that let a client freeze the server.
Invalid rotations
The plugin reads rotation angles (yaw/pitch) straight from the client packet, before the vanilla server validates them, so a client can send NaN or Infinity there. Such a value used to ripple through the rotation speed and acceleration maths for a few ticks and pollute the data window sent to the model. That tick is now simply skipped, and the next rotation is measured from the last valid one.