Apache Tomcat 8.0 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
Apache Tomcat 8.0 reached end of life on 30 Jun 2018. It no longer receives security fixes.
Support timeline
Official dates from the Apache Tomcat release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 29 Jan 2014 | — |
| End of life | 30 Jun 2018 | 8.1 years ago |
| Latest release | 8.0.53 · 29 Jun 2018 | final |
The cost of staying: CVEs since end of life
101 Apache Tomcat vulnerabilities have been published since 30 Jun 2018. All were fixed in supported branches — 8.0 received none of them. Source: NVD.
Apache Tomcat CVEs published since 8.0's EOL, by year
16 of the 101 are rated critical · data refreshed 2026-08-09
Published 24 Feb 2020 · rated critical — fixed in supported branches only, never in 8.0. Details
Published 18 Nov 2024 · rated critical — fixed in supported branches only, never in 8.0. Details
Published 17 Dec 2024 · rated critical — fixed in supported branches only, never in 8.0. Details
Where to go from 8.0
Recommended target: Apache Tomcat 11.0.
The newest actively supported branch is Apache Tomcat 11.0 (latest release 11.0.24). Review tomcat.apache.org before upgrading.
Frequently asked questions
Is Apache Tomcat 8.0 still safe to use?
No. Apache Tomcat 8.0 stopped receiving security fixes on 30 Jun 2018. Since then, 101 Apache Tomcat vulnerabilities have been published and fixed in supported branches — Apache Tomcat 8.0 received none of those fixes.
Can I still download Apache Tomcat 8.0?
Yes — the final release (8.0.53) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Apache Tomcat 8.0 to?
Upgrade to Apache Tomcat 11.0, the newest actively supported branch.