{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "item": { "id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "slug": "apache-tomcat-8-5-end-of-life-supported-9-10-1-11", "url": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11.md", "json": "https://update.dsesecurity.com/api/v1/posts/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/" }, "title": "Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported", "summary": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-18T21:00:50+00:00", "modified_at": "2026-10-18T22:22:07+00:00", "reviewed_on": "2026-10-18", "reading_minutes": 2, "word_count": 278, "potentially_affected": "Servers and appliances that run Java web applications on Tomcat, including web consoles for video management, access control, building automation and reporting tools that bundle their own Tomcat.", "dse_recommendation": "DSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0.", "primary_source": { "name": "Apache Software Foundation — Apache Tomcat Versions", "url": "https://tomcat.apache.org/whichversion.html", "published_on": null, "authority": "tomcat.apache.org" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.

\n

Source facts

\n

The Apache Tomcat versions page lists 11.0.x, 10.1.x and 9.0.x as currently supported, requiring Java 17, 11 and 8 or later respectively.

\n

Versions that have reached end-of-life include 10.0.x on 2022-10-31, 8.5.x on 2024-03-31, 8.0.x on 2018-06-30 and 7.0.x on 2021-03-31, and the project encourages users of these to upgrade to a supported version.

\n

The project strongly encourages users to run the latest stable version whenever possible, acknowledging that upgrading across major versions may not be trivial and that, because support is community-driven, the older the version, the fewer people will be interested or able to help.

\n

Applicability

\n

Use this for any Tomcat deployment you run or that ships inside a vendor product. Some vendors patch or replace bundled Tomcat on their own schedule, so ask whether their release includes a supported Tomcat line before upgrading it yourself.

\n

DSE recommendation

\n

DSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0. Check each one’s version from its server banner, manager page or installed files, confirm the Java version the target line requires, and ask the application vendor for a supported upgrade path rather than replacing their bundled server without guidance.

\n

Verification

\n

Keep a list of Tomcat instances with version, Java runtime and owning application, compare it with the supported list each quarter, and confirm after vendor updates that the bundled Tomcat moved to a supported line.

\n

Official reference

\n

Apache Software Foundation — Apache Tomcat Versions. Reviewed October 18, 2026.

", "content_text": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.\nSource facts\nThe Apache Tomcat versions page lists 11.0.x, 10.1.x and 9.0.x as currently supported, requiring Java 17, 11 and 8 or later respectively.\nVersions that have reached end-of-life include 10.0.x on 2022-10-31, 8.5.x on 2024-03-31, 8.0.x on 2018-06-30 and 7.0.x on 2021-03-31, and the project encourages users of these to upgrade to a supported version.\nThe project strongly encourages users to run the latest stable version whenever possible, acknowledging that upgrading across major versions may not be trivial and that, because support is community-driven, the older the version, the fewer people will be interested or able to help.\nApplicability\nUse this for any Tomcat deployment you run or that ships inside a vendor product. Some vendors patch or replace bundled Tomcat on their own schedule, so ask whether their release includes a supported Tomcat line before upgrading it yourself.\nDSE recommendation\nDSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0. Check each one’s version from its server banner, manager page or installed files, confirm the Java version the target line requires, and ask the application vendor for a supported upgrade path rather than replacing their bundled server without guidance.\nVerification\nKeep a list of Tomcat instances with version, Java runtime and owning application, compare it with the supported list each quarter, and confirm after vendor updates that the bundled Tomcat moved to a supported line.\nOfficial reference\nApache Software Foundation — Apache Tomcat Versions. Reviewed October 18, 2026.", "content_markdown": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.\n\n## Source facts\n\nThe [Apache Tomcat versions page](https://tomcat.apache.org/whichversion.html) lists 11.0.x, 10.1.x and 9.0.x as currently supported, requiring Java 17, 11 and 8 or later respectively.\n\nVersions that have reached end-of-life include 10.0.x on 2022-10-31, 8.5.x on 2024-03-31, 8.0.x on 2018-06-30 and 7.0.x on 2021-03-31, and the project encourages users of these to upgrade to a supported version.\n\nThe project strongly encourages users to run the latest stable version whenever possible, acknowledging that upgrading across major versions may not be trivial and that, because support is community-driven, the older the version, the fewer people will be interested or able to help.\n\n## Applicability\n\nUse this for any Tomcat deployment you run or that ships inside a vendor product. Some vendors patch or replace bundled Tomcat on their own schedule, so ask whether their release includes a supported Tomcat line before upgrading it yourself.\n\n## DSE recommendation\n\nDSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0. Check each one’s version from its server banner, manager page or installed files, confirm the Java version the target line requires, and ask the application vendor for a supported upgrade path rather than replacing their bundled server without guidance.\n\n## Verification\n\nKeep a list of Tomcat instances with version, Java runtime and owning application, compare it with the supported list each quarter, and confirm after vendor updates that the bundled Tomcat moved to a supported line.\n\n## Official reference\n\n[Apache Software Foundation — Apache Tomcat Versions](https://tomcat.apache.org/whichversion.html). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "url": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported", "item": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/#article", "identifier": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "url": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/", "headline": "Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported", "description": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on…", "abstract": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.", "articleBody": "The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.\nSource facts\nThe Apache Tomcat versions page lists 11.0.x, 10.1.x and 9.0.x as currently supported, requiring Java 17, 11 and 8 or later respectively.\nVersions that have reached end-of-life include 10.0.x on 2022-10-31, 8.5.x on 2024-03-31, 8.0.x on 2018-06-30 and 7.0.x on 2021-03-31, and the project encourages users of these to upgrade to a supported version.\nThe project strongly encourages users to run the latest stable version whenever possible, acknowledging that upgrading across major versions may not be trivial and that, because support is community-driven, the older the version, the fewer people will be interested or able to help.\nApplicability\nUse this for any Tomcat deployment you run or that ships inside a vendor product. Some vendors patch or replace bundled Tomcat on their own schedule, so ask whether their release includes a supported Tomcat line before upgrading it yourself.\nDSE recommendation\nDSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0. Check each one’s version from its server banner, manager page or installed files, confirm the Java version the target line requires, and ask the application vendor for a supported upgrade path rather than replacing their bundled server without guidance.\nVerification\nKeep a list of Tomcat instances with version, Java runtime and owning application, compare it with the supported list each quarter, and confirm after vendor updates that the bundled Tomcat moved to a supported line.\nOfficial reference\nApache Software Foundation — Apache Tomcat Versions. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:50+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 278, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Apache Software Foundation — Apache Tomcat Versions", "url": "https://tomcat.apache.org/whichversion.html" } } ] } }