Apache Tomcat 10.0 end of life
Apache Tomcat 10.0 reached end of life on 31 October 2022. The final release was 10.0.27, on 10 October 2022. Since then the Tomcat security team has not checked vulnerability reports against 10.0, so new advisories name 10.1 and later but say nothing about 10.0. Moving to 10.1 needs no namespace change, because 10.0 is already on jakarta.
- End of life
- 31 October 2022
- Released
- Dec 2020
- Final release
- 10.0.27 (10 October 2022)
- Successor
- Tomcat 10.1 or Tomcat 11.0
Date published by Apache Tomcat 10.0.x end-of-life notice. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 31 October 2022
- Releases on the 10.0.x branch. The project said further releases were highly unlikely, and 10.0.27 was the last.
- Checks of security reports against 10.0.x. A new Tomcat advisory lists 11.0, 10.1 and 9.0 and adds that other unsupported versions may also be affected.
- Fixes for bugs that affect only 10.0.x. Downloads and documentation links were removed from tomcat.apache.org after 31 January 2023, though every release stays in the archive.
What actually breaks in the upgrade
10.0 to 10.1 keeps the namespace
Tomcat 10.0 implements Servlet 5.0 and 10.1 implements Servlet 6.0, both in the jakarta namespace. The hard part of a Jakarta EE migration is already done, so this is a version move rather than a code migration. Servlet 6.0 dropped some long-deprecated API methods, so compile against 10.1 before you deploy.
Java 11 is the floor
Tomcat 10.0 runs on Java 8 and later. Tomcat 10.1 needs Java 11 and Tomcat 11.0 needs Java 17. An estate still on Java 8 has to move the JVM first, and that is often the longer job.
Known 10.0 exposure with no fix
CVE-2026-29146, a padding oracle in the EncryptInterceptor with its default configuration, affects 10.0.0-M1 through 10.1.52 according to NVD. The fix shipped in 10.1.53. No 10.0 release carries it, and later advisories do not assess 10.0 at all.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Tomcat 10.1 | Same jakarta namespace, Servlet 6.0, Java 11 or later. | Days to weeks | Engineering time | The shortest supported move from 10.0. |
| Upgrade to Tomcat 11.0 | Servlet 6.1 on Java 17 or later. | Weeks | Engineering time | Worth it if the JVM is moving to 17 anyway, since it skips a later hop. |
| OSSeva patched builds on 10.0 | Signed 10.0 builds with Tomcat security fixes backported. | Days | Subscription | Closes the gap while the Java and Tomcat upgrade is scheduled. |
| Stay unpatched | No upstream releases since October 2022. | None | Zero now | Scanners keep flagging new Tomcat CVEs, and nobody upstream checks whether 10.0 is affected. |
What OSSeva does for Apache Tomcat 10.0
OSSeva patches this line
OSSeva backports Tomcat security fixes to 10.0.x and ships them as signed builds on the Patch, Assure and Operate tiers, with Docker, apt, yum and zip delivery. The Assure tier adds a connector audit and a Tomcat 10.1 or 11 migration assessment, and the Operate tier runs the migration.
Apache Tomcat extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A component with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Apache Tomcat 10.0: common questions
When did Apache Tomcat 10.0 reach end of life?
On 31 October 2022. The final release was 10.0.27, on 10 October 2022.
Is Tomcat 10.0 affected by new Tomcat CVEs?
Often, but the advisories will not say so. The Tomcat team stopped checking reports against 10.0 when support ended. CVE-2026-29146 is one that NVD does list as affecting 10.0, with no 10.0 fix.
Is upgrading from Tomcat 10.0 to 10.1 hard?
Usually not. Both use the jakarta namespace. The main changes are Java 11 as the minimum and the removal of some deprecated Servlet API methods in Servlet 6.0.
What Java version does Tomcat 10.1 need?
Java 11 or later. Tomcat 10.0 ran on Java 8, and Tomcat 11.0 needs Java 17.
Can I get security patches for Tomcat 10.0?
Yes. OSSeva ships patched, signed Tomcat 10.0 builds on the Patch, Assure and Operate tiers.
Still running Apache Tomcat 10.0?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.