# Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported

> The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.

- Canonical URL: https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:00:50+00:00
- Modified: 2026-10-18T22:22:07+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Briefing
- DSE priority: Advisory
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.

## Potentially affected

Servers and appliances that run Java web applications on Tomcat, including web consoles for video management, access control, building automation and reporting tools that bundle their own Tomcat.

## DSE recommendation

DSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0.

## Article

The Apache Tomcat project lists 11.0.x, 10.1.x and 9.0.x as its supported versions. Tomcat 8.5 reached end of life on March 31, 2024 and 10.0 on October 31, 2022, so web consoles still bundling them no longer receive project fixes.

## Source facts

The [Apache Tomcat versions page](https://tomcat.apache.org/whichversion.html) lists 11.0.x, 10.1.x and 9.0.x as currently supported, requiring Java 17, 11 and 8 or later respectively.

Versions that have reached end-of-life include 10.0.x on 2022-10-31, 8.5.x on 2024-03-31, 8.0.x on 2018-06-30 and 7.0.x on 2021-03-31, and the project encourages users of these to upgrade to a supported version.

The project strongly encourages users to run the latest stable version whenever possible, acknowledging that upgrading across major versions may not be trivial and that, because support is community-driven, the older the version, the fewer people will be interested or able to help.

## Applicability

Use this for any Tomcat deployment you run or that ships inside a vendor product. Some vendors patch or replace bundled Tomcat on their own schedule, so ask whether their release includes a supported Tomcat line before upgrading it yourself.

## DSE recommendation

DSE recommends finding every Tomcat instance, including vendor-bundled copies, and moving unsupported versions to 9.0, 10.1 or 11.0. Check each one’s version from its server banner, manager page or installed files, confirm the Java version the target line requires, and ask the application vendor for a supported upgrade path rather than replacing their bundled server without guidance.

## Verification

Keep a list of Tomcat instances with version, Java runtime and owning application, compare it with the supported list each quarter, and confirm after vendor updates that the bundled Tomcat moved to a supported line.

## Official reference

[Apache Software Foundation — Apache Tomcat Versions](https://tomcat.apache.org/whichversion.html). Reviewed October 18, 2026.

## Primary reference

- Name: Apache Software Foundation — Apache Tomcat Versions
- Authority: tomcat.apache.org
- URL: https://tomcat.apache.org/whichversion.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Find bundled Apache Tomcat 8.5 and older: only 9.0, 10.1 and 11.0 are still supported,” DSE Security, https://update.dsesecurity.com/updates/apache-tomcat-8-5-end-of-life-supported-9-10-1-11/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.