Apache Tomcat 8.5 end of life
Apache Tomcat 8.5 reached end of life on 31 March 2024. The final release was 8.5.100. The Apache Tomcat project publishes no further security or bug-fix releases on the 8.5 line, and vulnerabilities found in it since that date remain unfixed upstream.
- End of life
- 31 March 2024
- Released
- Mar 2016
- Final release
- 8.5.100
- Successor
- Tomcat 9.0 (interim) or 10.1 (Jakarta EE)
Date published by Apache Tomcat versions page. We do not publish a lifecycle date we cannot source.
What actually stops on 31 March 2024
- All releases on the 8.5.x line. 8.5.100 was the last.
- Apache security advisories for Tomcat 8.5, though scanners continue to flag 8.5 against CVEs disclosed in later lines that also affect it.
What actually breaks in the upgrade
8.5 to 9 is the easy hop, and it is a dead end
Tomcat 8.5 to 9.0 is close to a drop-in move: both are javax-based, the configuration is largely compatible, and most applications deploy unchanged. The catch is that 9.0 itself reaches end of life on 31 March 2027, so this buys roughly a year from now. It is a legitimate step if the Jakarta migration is already scheduled, and a trap if it is being used to avoid scheduling it.
Go straight to 10.1 if the Jakarta work is unavoidable anyway
If the estate will have to make the javax to jakarta move regardless, doing it once from 8.5 to 10.1 is cheaper than doing 8.5 to 9 now and 9 to 10.1 in 2027.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Tomcat 10.1 | One move, including the Jakarta namespace migration. | Weeks | Engineering time | Best value if you are going to do the Jakarta work anyway. |
| Upgrade to Tomcat 9.0 | Near drop-in, buys time until 31 March 2027. | Days | Engineering time | Fine as a deliberate step with the Jakarta migration already on the roadmap. Not fine as a way to avoid it. |
| Extended support on 8.5 | Backported CVE fixes on the 8.5 line. | Days | Subscription | Right when a third-party WAR pins you to 8.5 and cannot be rebuilt. |
| Stay unpatched | Two years of unpatched CVEs on an edge component. | None | Zero now | Least defensible position in this list. Tomcat is usually the internet-facing tier. |
What OSSeva does for Apache Tomcat 8.5
OSSeva patches this line
OSSeva backports CVE fixes to Tomcat 8.5 and ships signed builds through your repository manager. Because Tomcat generally sits at the edge, we prioritise its backports rather than batching them into a quarterly release.
Apache Tomcat extended supportWhat your auditor will say
Requirement 6.3.3, applied to the application tier. Two years of unpatched CVEs on an internet-facing component is a straightforward finding.
CC7.1. Tomcat versions are trivially fingerprinted, so this appears in external scan evidence as well as internal inventory.
Apache Tomcat 8.5: common questions
When did Tomcat 8.5 reach end of life?
31 March 2024. The final release on the line was 8.5.100, and the Apache Tomcat project has published nothing on 8.5 since.
Is Tomcat 8.5 still supported?
No. It has been end of life since 31 March 2024. Third-party extended support is the only remaining patch source.
Should I upgrade Tomcat 8.5 to 9 or to 10.1?
To 10.1 if you can. Tomcat 9 reaches end of life on 31 March 2027, so an 8.5 to 9 move buys about a year. If the javax to jakarta migration is unavoidable, doing it once is cheaper than doing two upgrades.
Is upgrading Tomcat 8.5 to 9 difficult?
Usually not. Both are javax-based with largely compatible configuration, and most applications deploy unchanged. The difficulty is in 9 to 10.1, which is the Jakarta namespace migration.
Can I get security patches for Tomcat 8.5?
Yes, from a third-party provider. OSSeva backports CVE fixes to the 8.5 line and delivers signed builds through your own repository manager.
Still running Apache Tomcat 8.5?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.