Apache Tomcat 8.5 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
Apache Tomcat 8.5 reached end of life on 31 Mar 2024. It no longer receives security fixes.
Support timeline
Official dates from the Apache Tomcat release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 17 Mar 2016 | — |
| End of life | 31 Mar 2024 | 2.4 years ago |
| Latest release | 8.5.100 · 19 Mar 2024 | final |
The cost of staying: CVEs since end of life
53 Apache Tomcat vulnerabilities have been published since 31 Mar 2024. All were fixed in supported branches — 8.5 received none of them. Source: NVD.
Apache Tomcat CVEs published since 8.5's EOL, by year
15 of the 53 are rated critical · data refreshed 2026-08-09
Published 18 Nov 2024 · rated critical — fixed in supported branches only, never in 8.5. Details
Published 17 Dec 2024 · rated critical — fixed in supported branches only, never in 8.5. Details
Published 20 Dec 2024 · rated critical — fixed in supported branches only, never in 8.5. Details
Where to go from 8.5
Recommended target: Apache Tomcat 11.0.
The newest actively supported branch is Apache Tomcat 11.0 (latest release 11.0.24). Review tomcat.apache.org before upgrading.
Frequently asked questions
Is Apache Tomcat 8.5 still safe to use?
No. Apache Tomcat 8.5 stopped receiving security fixes on 31 Mar 2024. Since then, 53 Apache Tomcat vulnerabilities have been published and fixed in supported branches — Apache Tomcat 8.5 received none of those fixes.
Can I still download Apache Tomcat 8.5?
Yes — the final release (8.5.100) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Apache Tomcat 8.5 to?
Upgrade to Apache Tomcat 11.0, the newest actively supported branch.