Apache Tomcat ↗

Apache · Web / Runtime

Track your version:Monitors Apache Tomcat and tailors your dashboard to that exact version.

11.0.25 · latest cycle100/100 Healthy

Summary iPlain-English security verdict for Apache Tomcat, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

Apache Tomcat currently scores 100/100 — healthy. 6 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2023-44487) — staying on the latest supported version keeps you clear of them. The latest supported release is 11.0.25. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for Apache Tomcat each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

1 of its known vulnerability is linked to ransomware campaigns (CISA KEV).

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2023-44487 HIGH exploited Uncontrolled resource consumption EPSS 100% → see advisory CVE-2017-12617 HIGH exploited Unrestricted file upload EPSS 100% → fixed in 9.0.1 CVE-2017-12615 HIGH exploited ransomware Unrestricted file upload EPSS 100% → see advisory CVE-2020-1938 CRITICAL exploited EPSS 99% → fixed in 9.0.31 CVE-2016-8735 CRITICAL exploited EPSS 90% → fixed in 8.5.7 CVE-2026-34486 HIGH exploited CWE-311 EPSS 81% → see advisory CVE-2020-13935 HIGH CWE-835 EPSS 87% → see advisory CVE-2021-33037 MEDIUM CWE-444 EPSS 75% → see advisory CVE-2020-13934 HIGH CWE-401 EPSS 64% → see advisory CVE-2020-9484 HIGH Insecure deserialization EPSS 57% → fixed in 9.0.43 CVE-2026-65905 CRITICAL CWE-294 EPSS 1% → fixed in 11.0.25 CVE-2026-68525 CRITICAL Incorrect authorization EPSS 1% → fixed in 11.0.25

See all 37 known Apache Tomcat CVEs & security history →

Get alerted about Apache Tomcat

Be emailed the moment Apache Tomcat gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for Apache Tomcat — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each Apache Tomcat release line is supported — and when it sunsets. Select a line for its full report.

Mar31'27 Apache Tomcat 9.0EOL 2027-03-31

Mar31'24 Apache Tomcat 8.5ended 2024-03-31

Oct31'22 Apache Tomcat 10.0ended 2022-10-31

Mar31'21 Apache Tomcat 7ended 2021-03-31

Jun30'18 Apache Tomcat 8.0ended 2018-06-30

Dec31'16 Apache Tomcat 6ended 2016-12-31

Sept30'12 Apache Tomcat 5ended 2012-09-30

Full Apache Tomcat end-of-life dates & support timeline →

11.0 latest 11.0.25 Supported 11.0.25 → 10.1 latest 10.1.59 Supported 10.1.59 → 10.0 latest 10.0.27 End of life ended 2022-10-3110.0.27 → 9.0 latest 9.0.121 Supported until 2027-03-319.0.121 → 8.5 latest 8.5.100 End of life ended 2024-03-318.5.100 → 8.0 latest 8.0.53 End of life ended 2018-06-308.0.53 → 7 latest 7.0.109 End of life ended 2021-03-317.0.109 → 6 latest 6.0.53 End of life ended 2016-12-316.0.53 → 5 latest 5.5.36 End of life ended 2012-09-305.5.36 → See all upcoming end-of-life dates →

Frequently asked

Is Apache Tomcat safe and patched?

What should I do about Apache Tomcat now?

Upgrade Apache Tomcat to the latest supported release (11.0.25) or later, which clears the actively-exploited issues affecting older versions, then confirm against Apache's official advisory.

When does Apache Tomcat reach end-of-life?

The latest supported Apache Tomcat release is 11.0.25. After end-of-life a release no longer receives security patches.

Which versions of Apache Tomcat are still receiving security updates?

Supported Apache Tomcat release lines (latest 11.0.25): 11.0, 10.1, 9.0. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade — Apache Tomcat official site ↗