PRIMARYManual
Apache Tomcat 8.5.x official lifecycle source
support for Apache Tomcat 8.5.x will end on 31 March 2024.
Publisher identity used by product-specific official-source collectors.
Open official vendor source
← Search results
REVIEWED ORIGINAL-SOURCE CLAIMOFFICIAL VENDOR SOURCEREVIEWED 13 SEP 2026
Apache · EDITORIAL PRIMARY-SOURCE REVIEW
Apache Tomcat 8.5.x
Apache Tomcat 8.5.x is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This claim was manually scoped and reviewed against the linked original publisher statement. It applies only to the named release and support phase. Confirm edition, device and contract applicability before acting.
Claim scope: Upstream Apache Tomcat project support for the 8.5.x branch only; not vendor distributions or separate commercial support.
Reviewed 13 Sep 2026.
Product overview
Apache Tomcat 8.5.x is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Main capabilities
- Networked or application service delivery
- Administrative and operational interfaces
- Versioned maintenance and security updates
Typical use
Used to provide application, infrastructure or operational services to other systems and users.
Deployment
Deployed on servers, virtual machines, containers or managed infrastructure.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
Collected lifecycle data
| Product | Apache Tomcat 8.5.x |
|---|---|
| Release | 8.5.x |
| End of End of Apache Tomcat project support | 31 March 2024 |
| Date precision | Day |
Known exploited vulnerabilities
Catalogue updated 28 Oct 2026These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
No CISA known-exploited entries currently match this mapped product family.
This does not mean the product has no vulnerabilities.
Package vulnerability advisories
OSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
No package advisories have been linked for this product identity.
This is not evidence that the product has no vulnerabilities.