Apache Tomcat ↗

Apache · Web / Runtime

Track your version:Monitors Apache Tomcat and tailors your dashboard to that exact version.

11.0.24 · latest cycle100/100 Healthy

Summary iPlain-English security verdict for Apache Tomcat, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

Apache Tomcat currently scores 100/100 — healthy. 1 actively-exploited vulnerability (CISA KEV) affects older releases (e.g. CVE-2017-12615) — staying on the latest supported version keeps you clear of it. The latest supported release is 11.0.24. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for Apache Tomcat each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

1 of its known vulnerability is linked to ransomware campaigns (CISA KEV).

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2017-12615 HIGH exploited ransomware Unrestricted file upload EPSS 100% → see advisory CVE-2026-53434 CRITICAL CWE-390 EPSS 0% → fixed in 11.0.23 CVE-2026-55276 CRITICAL CWE-670 EPSS 0% → fixed in 11.0.23 CVE-2026-59084 CRITICAL CWE-1059 EPSS 0% → see advisory CVE-2026-59083 CRITICAL CWE-177 EPSS 0% → see advisory

See all 13 known Apache Tomcat CVEs & security history →

Get alerted about Apache Tomcat

Be emailed the moment Apache Tomcat gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for Apache Tomcat — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each Apache Tomcat release line is supported — and when it sunsets. Select a line for its full report.

Mar31'27 Apache Tomcat 9.0EOL 2027-03-31

Mar31'24 Apache Tomcat 8.5ended 2024-03-31

Oct31'22 Apache Tomcat 10.0ended 2022-10-31

Mar31'21 Apache Tomcat 7ended 2021-03-31

Jun30'18 Apache Tomcat 8.0ended 2018-06-30

Dec31'16 Apache Tomcat 6ended 2016-12-31

Sept30'12 Apache Tomcat 5ended 2012-09-30

Full Apache Tomcat end-of-life dates & support timeline →

11.0 latest 11.0.24 Supported 11.0.24 → 10.1 latest 10.1.57 Supported 10.1.57 → 10.0 latest 10.0.27 End of life ended 2022-10-3110.0.27 → 9.0 latest 9.0.120 Supported until 2027-03-319.0.120 → 8.5 latest 8.5.100 End of life ended 2024-03-318.5.100 → 8.0 latest 8.0.53 End of life ended 2018-06-308.0.53 → 7 latest 7.0.109 End of life ended 2021-03-317.0.109 → 6 latest 6.0.53 End of life ended 2016-12-316.0.53 → 5 latest 5.5.36 End of life ended 2012-09-305.5.36 → See all upcoming end-of-life dates →

Frequently asked

Is Apache Tomcat safe and patched?

What should I do about Apache Tomcat now?

Upgrade Apache Tomcat to the latest supported release (11.0.24) or later, which clears the actively-exploited issues affecting older versions, then confirm against Apache's official advisory.

When does Apache Tomcat reach end-of-life?

The latest supported Apache Tomcat release is 11.0.24. After end-of-life a release no longer receives security patches.

Which versions of Apache Tomcat are still receiving security updates?

Supported Apache Tomcat release lines (latest 11.0.24): 11.0, 10.1, 9.0. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade — Apache Tomcat official site ↗