← ← Back to all productsOpen the CISA KEV catalog ↗
Apache Tomcat
Active
Server SoftwareLatest Version: 10.1.59Latest Release: Aug 13, 2026
Apache Tomcat is an open-source Java Servlet container and web server for Java web applications.
CISA known-exploited vulnerability signal
CISA KEV catalog version 2026.08.20 includes 6 manually mapped record(s) for this product.
Newest matching record added: Aug 4, 2026
This is a product-level catalog match, not a finding that the version shown above is vulnerable. Review each vendor advisory and affected-version range before acting.
Matching CVEs (showing up to 6)
- CVE-2026-34486
- CVE-2025-24813
- CVE-2016-8735
- CVE-2017-12615
- CVE-2017-12617
- CVE-2020-1938
Support summary
Apache Tomcat currently has supported cycles. Track the next EOL date and validate upgrades before your change window.
What do EOL and support statuses mean?Next EOL
Mar 31, 2027
Apache Tomcat 9.0 · 222 days left
Supported cycles
3
0 lts
Versions
9
Latest Version
10.1.59
Active Support
3
EOL
6
Lifecycle Timeline
Today ↓
11.0
11.0
10.1
10.1
10.0
10.0
9.0
9.0
8.5
8.5
8.0
8.0
7
7
6
6
5
5
Active SupportSecurity SupportEOL
Versions
| Release | Release Date | Active Support | EOL | Latest Version | LTS | Status |
|---|---|---|---|---|---|---|
| 11.0 | Oct 3, 2024 | Yes | No | 11.0.25 | No | Active |
| 10.1 | Sep 23, 2022 | Yes | No | 10.1.59 | No | Active |
| 10.0 | Dec 3, 2020 | No | Oct 31, 2022 | 10.0.27 | No | EOL |
| 9.0 | Sep 27, 2017 | Yes | Mar 31, 2027 | 9.0.121 | No | Active |
| 8.5 | Mar 17, 2016 | No | Mar 31, 2024 | 8.5.100 | No | EOL |
| 8.0 | Jan 29, 2014 | No | Jun 30, 2018 | 8.0.53 | No | EOL |
| 7 | Jan 10, 2013 | No | Mar 31, 2021 | 7.0.109 | No | EOL |
| 6 | Oct 21, 2006 | No | Dec 31, 2016 | 6.0.53 | No | EOL |
| 5 | Sep 6, 2003 | No | Sep 30, 2012 | 5.5.36 | No | EOL |
Data sources
Frequently Asked Questions
Which versions of Apache Tomcat have reached end of life?
The following Apache Tomcat versions have reached end of life and no longer receive security updates: 10.0, 8.5, 8.0, 7, 6, 5. It is recommended to upgrade to a supported version.
Is it safe to continue using Apache Tomcat 10.0?
Apache Tomcat 10.0 has reached end of life and no longer receives security patches or bug fixes. Continuing to use it may expose your systems to known vulnerabilities. We strongly recommend upgrading to a supported version.
What is the latest version of Apache Tomcat?
The latest version of Apache Tomcat is 10.1.59, released in the 10.1 release cycle.
How many versions of Apache Tomcat are currently supported?
Apache Tomcat currently has 3 actively supported version(s): 11.0, 10.1, 9.0.
When does Apache Tomcat 11.0 reach end of life?
Apache Tomcat 11.0 does not have a specific end-of-life date announced yet.
What should I do when Apache Tomcat reaches end of life?
When a Apache Tomcat version reaches end of life, you should: 1) Plan your migration to a supported version as soon as possible. 2) Review the release notes for breaking changes. 3) Test your applications thoroughly in a staging environment. 4) Update your dependencies to ensure compatibility with the new version.