Apache Tomcat 4 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
Apache Tomcat 4 reached end of life on 25 Jun 2009. It no longer receives security fixes.
Support timeline
Official dates, read directly from tomcat.apache.org and archive.apache.org.
| Milestone | Date | Status |
|---|---|---|
| Initial release | — | — |
| Security Support ended | 25 Jun 2009 | 17y 3mo ago |
| Latest release | 4.1.40 · 25 Jun 2009 | final |
The cost of staying: CVEs since end of life
209 Apache Tomcat vulnerabilities have been published since 25 Jun 2009. All were fixed in supported branches — 4 received none of them. Source: NVD.
Apache Tomcat CVEs published since 4's EOL, by year
25 of the 209 are rated critical · data refreshed 2026-10-05
Published 6 Apr 2017 · rated critical — fixed in supported branches only, never in 4. Details
Published 17 Apr 2017 · rated critical — fixed in supported branches only, never in 4. Details
Published 16 May 2018 · rated critical — fixed in supported branches only, never in 4. Details
Where to go from 4
Recommended target: Apache Tomcat 11.0.
The newest actively supported branch is Apache Tomcat 11.0 (latest release 11.0.26). Review tomcat.apache.org before upgrading.
Frequently asked questions
Is Apache Tomcat 4 still safe to use?
No. Apache Tomcat 4 stopped receiving security fixes on 25 Jun 2009. Since then, 209 Apache Tomcat vulnerabilities have been published and fixed in supported branches — Apache Tomcat 4 received none of those fixes.
Can I still download Apache Tomcat 4?
Yes — the final release (4.1.40) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Apache Tomcat 4 to?
Upgrade to Apache Tomcat 11.0, the newest actively supported branch.