Apache Tomcat

Apache Tomcat is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.

Lifecycle status

No support or retirement date is shown unless BlackTree can link it to a registered publisher source. A missing date means that a boundary is not publicly stated, has not yet been extracted, or still needs source routing. It does not mean the product is supported indefinitely.

Product overview

Apache Tomcat is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.

Main capabilities

Networked or application service delivery
Administrative and operational interfaces
Versioned maintenance and security updates

Typical use

Used to provide application, infrastructure or operational services to other systems and users.

Deployment

Deployed on servers, virtual machines, containers or managed infrastructure.

Lifecycle records

Release	Boundary	Date
2.2	Retirement ends	9 March 2004
2.3	Retirement ends	25 June 2009
2.5	Retirement ends	31 December 2016
3.0	Retirement ends	31 March 2021
5.0	Retirement ends	31 October 2022
3.1	Retirement ends	31 March 2024
Product policy	End of support	31 March 2027

Official sources

VERIFIED

Apache Tomcat official lifecycle source

Checked automatically.

Extracted 7 lifecycle record(s), including 7 bounded date record(s), from the registered official source.

Open publisher source

Package vulnerability advisories

CVE-2026-65905

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Fixed: 11.0.25, 10.1.58, 9.0.121

CVE-2026-65182

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Fixed: 11.0.25, 10.1.58, 9.0.121

CVE-2026-68525

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Fixed: 11.0.25, 10.1.58, 9.0.121

CVE-2026-34487

Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Fixed: 9.0.117, 10.1.54, 11.0.21

CVE-2026-34483

Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Fixed: 9.0.116, 10.1.54, 11.0.21

CVE-2026-41284

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Fixed: 9.0.118, 10.1.55, 11.0.22

CVE-2025-66614

Apache Tomcat - Client certificate verification bypass

Fixed: 11.0.15, 10.1.50, 9.0.113

CVE-2026-25854

Apache Tomcat has an Open Redirect vulnerability

Fixed: 9.0.116, 10.1.53, 11.0.20