Security support for end-of-life Apache Tomcat
Apache Tomcat 8.5 reached end of life on 31 March 2024, Tomcat 8.0 in 2018 and Tomcat 7 in 2021. These are their last releases, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentTomcat versions past end of life
| Apache Tomcat | Release | End of life | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 7.0.109 | Last Apache Tomcat 7 release | 31 March 2021 | 22 | 9 | 1 | Patch on order, 48 h |
| 8.0.53 | Last Apache Tomcat 8.0 release | 30 June 2018 | 7 | 2 | 1 | Patch on order, 48 h |
| 8.5.100 | Last Apache Tomcat 8.5 release | 31 March 2024 | 29 | 11 | 1 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Apache Tomcat itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
Java libraries
Spring Framework, Spring Boot, Apache Tomcat and Log4j: the versions past end of life and what affects them. All Java libraries
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans