OSSEVA FOR APACHE TOMCAT
Apache Tomcat support: patched, protected, operated.
OSSeva provides Apache Tomcat support for 8.5.x, 9.0.x, 10.0.x, 10.1.x and 11.x, including patched builds for 8.5.x and 10.0.x now that the Apache Tomcat project no longer fixes them, and for 9.0.x after Apache support ends on 31 March 2027. Drop-in CVE patches for Tomcat 8.5.x and 9.0.x — including EncryptInterceptor bypass and classloader vulnerabilities the upstream project has closed. OSSeva keeps the servlet container running your enterprise Java applications patched and compliant.
Last reviewed
Trusted globally by enterprises
Why now
Tomcat 8.5.x community EOL: March 2024
Apache Tomcat 8.5.x reached community end of life on 31 March 2024, and 10.0.x on 31 October 2022. Tomcat 9.0.x support ends on 31 March 2027, with releases continuing on a separate 9.1.x branch until 31 December 2030. Applications pinned to 8.5, 10.0 or a 9.0 build that cannot move to 9.1.x have no upstream CVE patch path.
Clustered session replication is a high-value target
Tomcat clusters replicate session state between members, and the EncryptInterceptor that protects that traffic is only as good as the release it ships in. Once a Tomcat line stops receiving fixes, weaknesses in cluster membership or message handling become permanent — and an attacker with a foothold on the same network segment is reading or injecting session data, not just crashing a node.
Java 8 dependency creates compounded upgrade risk
Many Tomcat 8.5.x deployments run on Java 8, which left Oracle Premier Support in 2022. Upgrading Tomcat and the JDK simultaneously is a significant operational risk for enterprises with large Java application portfolios. OSSeva covers Tomcat on your current JDK.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 8.5.x(Community EOL March 2024) | Extended | 1 open |
| 9.0.x(Apache support to 31 Mar 2027; OSSeva backports after) | Current | Clean |
| 10.0.x(Full CVE coverage) | Extended | Clean |
| 10.1.x | Current | Clean |
| 11.x | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Tomcat 8.5.x–10.x. Signed builds, all deployment types.
- Quarterly CVE patches for Tomcat 8.5.x, 9.0.x, and 10.x
- EncryptInterceptor and classloader CVE priority coverage
- Docker / apt / yum / zip delivery
- Signed artifacts (GPG)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus Tomcat hardening review and compliance documentation.
- Everything in Patch
- Tomcat security configuration hardening review
- Connector (HTTP/HTTPS/AJP) configuration audit
- SOC 2 / PCI DSS attestation package
- JVM upgrade sequencing plan
- Tomcat 10/11 migration assessment
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 monitoring, 15-min SLA, named Tomcat engineers.
- Everything in Assure
- 24/7 JVM and Tomcat health monitoring
- 15-minute P1 incident response SLA
- Named senior Tomcat engineer on your account
- Thread pool and connection pool monitoring
- GC and heap alerting
- Tomcat major version migration execution
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
docker pull artifacts.osseva.io/tomcat:9.0.87-osseva-1-jdk11
docker run -d \
--name tomcat \
-p 8080:8080 \
-v ./webapps:/usr/local/tomcat/webapps \
artifacts.osseva.io/tomcat:9.0.87-osseva-1-jdk11# Add OSSeva apt repository
curl -fsSL https://packages.osseva.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/osseva.gpg
echo "deb [signed-by=/usr/share/keyrings/osseva.gpg] https://packages.osseva.io/apt stable main" \
| sudo tee /etc/apt/sources.list.d/osseva.list
sudo apt-get update
sudo apt-get install -y osseva-tomcat9=9.0.87-osseva-1Migrate from Oracle WebLogic / IBM WebSphere
Teams migrating from Oracle WebLogic or IBM WebSphere to Apache Tomcat often land on 8.5.x or 9.0.x — and then discover those versions are EOL before their migration is complete. OSSeva provides CVE coverage for the Tomcat version you landed on while you complete the migration or plan the next upgrade.
Pricing model
OSSeva for Tomcat is priced per application server, not by CPU core count or deployment. Book a discovery call for a quote.
Frequently asked questions
Does OSSeva cover Tomcat running embedded in Spring Boot?
Yes. Spring Boot embeds Tomcat as the default servlet container. OSSeva Spring Boot coverage includes the embedded Tomcat version. You do not need a separate Tomcat engagement if your Tomcat is embedded in a Spring Boot application covered by OSSeva.
How exposed is Tomcat cluster session replication?
More exposed than most teams assume. Cluster members exchange serialized session state and trust one another by membership rather than by per-message authentication, so anything that can join the cluster channel — or sit on its network segment — is inside the trust boundary. Tomcat 8.5 reached end of life on 31 March 2024, so fixes in this area no longer reach it upstream. OSSeva patches the 8.5.x and 9.0.x lines directly.
Do you support Tomcat on Java 8?
Yes. OSSeva supports Tomcat 8.5.x and 9.0.x on Java 8. If your environment is locked to Java 8 for application compatibility reasons, OSSeva can cover Tomcat on your current JDK without forcing a JVM upgrade.
What does the Tomcat 10/11 migration assessment include?
The migration assessment covers: Jakarta namespace migration impact (javax.* to jakarta.* for Tomcat 10+), web.xml and context.xml changes, connector configuration updates, JNDI resource reconfiguration, and application compatibility testing approach.
Does OSSeva cover the AJP connector? Is it still safe to use?
Yes, OSSeva covers the AJP connector. The AJP connector (Ghostcat class vulnerabilities) was a major patch priority in 2020 and remains in scope for ongoing monitoring. OSSeva's Assure tier includes an AJP connector configuration audit — many deployments still have AJP enabled unnecessarily.
Who provides Apache Tomcat support besides the Apache Tomcat project?
The Apache Tomcat project ships community releases and fixes for the lines it still supports. Other options are commercial vendors and cloud services that bundle Tomcat into a platform they support, and third-party support companies. OSSeva is a third-party option: one contract across your Java and data stack, end-of-life Tomcat lines included, with Docker, apt, yum and zip builds for wherever your servers run.
Does OSSeva support current Tomcat versions or only end-of-life ones?
Both. OSSeva covers the current 10.1.x and 11.x lines and Tomcat 9.0.x, which Apache supports until 31 March 2027, with releases continuing on a separate 9.1.x branch until 31 December 2030. For applications that cannot move to 9.1.x, OSSeva backports fixes to 9.0.x after Tomcat 9 end of life, and it already patches 8.5.x and 10.0.x. OSSeva Operate adds 24/7 JVM and Tomcat health monitoring and a 15-minute P1 incident response SLA.
How is OSSeva Tomcat support priced?
Per application server. The tier sets what is included: Patch for signed CVE patches, Assure for a hardening review and compliance documentation, and Operate for 24/7 monitoring with a named Tomcat engineer. Book a discovery call for a quote.
Ready to get Apache Tomcat patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.