Apache Tomcat 10.0 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
Apache Tomcat 10.0 reached end of life on 31 Oct 2022. It no longer receives security fixes.
Support timeline
Official dates from the Apache Tomcat release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 3 Dec 2020 | — |
| End of life | 31 Oct 2022 | 3.8 years ago |
| Latest release | 10.0.27 · 3 Oct 2022 | final |
The cost of staying: CVEs since end of life
67 Apache Tomcat vulnerabilities have been published since 31 Oct 2022. All were fixed in supported branches — 10.0 received none of them. Source: NVD.
Apache Tomcat CVEs published since 10.0's EOL, by year
15 of the 67 are rated critical · data refreshed 2026-08-09
Published 18 Nov 2024 · rated critical — fixed in supported branches only, never in 10.0. Details
Published 17 Dec 2024 · rated critical — fixed in supported branches only, never in 10.0. Details
Published 20 Dec 2024 · rated critical — fixed in supported branches only, never in 10.0. Details
Where to go from 10.0
Recommended target: Apache Tomcat 11.0.
The newest actively supported branch is Apache Tomcat 11.0 (latest release 11.0.24). Review tomcat.apache.org before upgrading.
Frequently asked questions
Is Apache Tomcat 10.0 still safe to use?
No. Apache Tomcat 10.0 stopped receiving security fixes on 31 Oct 2022. Since then, 67 Apache Tomcat vulnerabilities have been published and fixed in supported branches — Apache Tomcat 10.0 received none of those fixes.
Can I still download Apache Tomcat 10.0?
Yes — the final release (10.0.27) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Apache Tomcat 10.0 to?
Upgrade to Apache Tomcat 11.0, the newest actively supported branch.