Apache Tomcat 8.5 end of life
Apache Tomcat 8.5 reached end of life on 31 March 2024. The final release was 8.5.100. The Apache Tomcat project publishes no further security or bug-fix releases on the 8.5 line, and vulnerabilities found in it since that date remain unfixed upstream.
What now
Which vendors provide Apache Tomcat 8.5 security patches now that support has ended?
Tomcat 9 Extended Support and Security Patching- End of life
- 31 March 2024
- Released
- Mar 2016
- Final release
- 8.5.100
- Successor
- Tomcat 9.0 (interim) or 10.1 (Jakarta EE)
Date published by Apache Tomcat versions page. We do not publish a lifecycle date we cannot source.
Last reviewed
Apache Tomcat versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Apache Tomcat 10.1 | 26 Sept 2022 | No date announced | Supported |
| Apache Tomcat 10.0 | 8 Dec 2020 | 31 October 2022 | End of life |
| Apache Tomcat 9.0 | 27 Sept 2017 | 31 March 2027 | Approaching |
| Apache Tomcat 8.5 (this page) | 17 Mar 2016 | 31 March 2024 | End of life |
| Apache Tomcat 7 | 29 Jun 2010 | 31 March 2021 | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 31 March 2024
- All releases on the 8.5.x line. 8.5.100 was the last.
- Apache security advisories for Tomcat 8.5, though scanners continue to flag 8.5 against CVEs disclosed in later lines that also affect it.
What actually breaks in the upgrade
8.5 to 9 is the easy hop, and it is a dead end
Tomcat 8.5 to 9.0 is close to a drop-in move: both are javax-based, the configuration is largely compatible, and most applications deploy unchanged. The catch is that 9.0 itself reaches end of life on 31 March 2027, so this buys roughly a year from now. It is a legitimate step if the Jakarta migration is already scheduled, and a trap if it is being used to avoid scheduling it.
Go straight to 10.1 if the Jakarta work is unavoidable anyway
If the estate will have to make the javax to jakarta move regardless, doing it once from 8.5 to 10.1 is cheaper than doing 8.5 to 9 now and 9 to 10.1 in 2027.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Tomcat 10.1 | One move, including the Jakarta namespace migration. | Weeks | Engineering time | Best value if you are going to do the Jakarta work anyway. |
| Upgrade to Tomcat 9.0 | Near drop-in, buys time until 31 March 2027. | Days | Engineering time | Fine as a deliberate step with the Jakarta migration already on the roadmap. Not fine as a way to avoid it. |
| Extended support on 8.5 | Backported CVE fixes on the 8.5 line. | Days | Subscription | Right when a third-party WAR pins you to 8.5 and cannot be rebuilt. |
| Stay unpatched | Two years of unpatched CVEs on an edge component. | None | Zero now | Least defensible position in this list. Tomcat is usually the internet-facing tier. |
What OSSeva does for Apache Tomcat 8.5
OSSeva patches this line
OSSeva backports CVE fixes to Tomcat 8.5 and ships signed builds through your repository manager. Because Tomcat generally sits at the edge, we prioritise its backports rather than batching them into a quarterly release.
Apache Tomcat extended supportWhat your auditor will say
Requirement 6.3.3, applied to the application tier. Two years of unpatched CVEs on an internet-facing component is a straightforward finding.
CC7.1. Tomcat versions are trivially fingerprinted, so this appears in external scan evidence as well as internal inventory.
When did Tomcat 8.5 reach end of life?
31 March 2024. The final release on the line was 8.5.100, and the Apache Tomcat project has published nothing on 8.5 since.
Is Tomcat 8.5 still supported?
No. It has been end of life since 31 March 2024. Third-party extended support is the only remaining patch source.
Should I upgrade Tomcat 8.5 to 9 or to 10.1?
To 10.1 if you can. Tomcat 9 reaches end of life on 31 March 2027, so an 8.5 to 9 move buys about a year. If the javax to jakarta migration is unavoidable, doing it once is cheaper than doing two upgrades.
Is upgrading Tomcat 8.5 to 9 difficult?
Usually not. Both are javax-based with largely compatible configuration, and most applications deploy unchanged. The difficulty is in 9 to 10.1, which is the Jakarta namespace migration.
Can I get security patches for Tomcat 8.5?
Yes, from a third-party provider. OSSeva backports CVE fixes to the 8.5 line and delivers signed builds through your own repository manager.
Get a quote
Still running Apache Tomcat 8.5?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?