Overly permissive RPKI ROAs leave 18 million routes open to forged-origin hijacks

An analysis of 855,217 RPKI-covered IPv4 routes found 16.2% (138,698) have ROAs whose maxLength exceeds the announced prefix, rising to 20.9% for IPv6. That enables roughly 18 million forged more-specific prefixes to pass validation, as demonstrated by the August 28 attack on Virtualizor update servers via a forged /24 inside Hetzner's /16 block.

• 16.2% of IPv4 and 20.9% of IPv6 RPKI routes are vulnerable to forged-origin hijacks
• Contabo has 97.6% permissive ROAs, DigitalOcean 90.4%, OVH only 11.5%
• The Virtualizor attack used a forged /24 inside Hetzner's /16 with maxLength 24
• RFC 9319 recommends leaving maxLength unset so ROAs match only the exact prefix