# Apache Tomcat

Latest release: 11.0.27. Known vulnerabilities: 147. Actively exploited: 7. Vendor advisories: [https://tomcat.apache.org/security.html](https://tomcat.apache.org/security.html)

Check any version: https://fixedin.dev/tomcat/{version}.md (for example https://fixedin.dev/tomcat/11.0.27.md).

## Release lines

| Line | Latest | Status | Check |
|---|---|---|---|
| 11.0 | 11.0.27 | supported | https://fixedin.dev/tomcat/11.0.27.md |
| 10.1 | 10.1.61 | supported | https://fixedin.dev/tomcat/10.1.61.md |
| 10.0 | 10.0.27 | end of life since 2022-10-31 | https://fixedin.dev/tomcat/10.0.27.md |
| 9.0 | 9.0.123 | supported until 2027-03-31 | https://fixedin.dev/tomcat/9.0.123.md |
| 8.5 | 8.5.100 | end of life since 2024-03-31 | https://fixedin.dev/tomcat/8.5.100.md |
| 8.0 | 8.0.53 | end of life since 2018-06-30 | https://fixedin.dev/tomcat/8.0.53.md |
| 7 | 7.0.109 | end of life since 2021-03-31 | https://fixedin.dev/tomcat/7.0.109.md |
| 6 | 6.0.53 | end of life since 2016-12-31 | https://fixedin.dev/tomcat/6.0.53.md |
| 5 | 5.5.36 | end of life since 2012-09-30 | https://fixedin.dev/tomcat/5.5.36.md |

## Actively exploited

- [CVE-2026-34486](https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly), added to CISA KEV 2026-08-04
- [CVE-2025-24813](https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq), added to CISA KEV 2025-04-01
- [CVE-2023-44487](https://github.com/advisories/GHSA-qppj-fm5r-hxr3), added to CISA KEV 2023-10-10
- [CVE-2016-8735](https://access.redhat.com/errata/RHSA-2017:0455), added to CISA KEV 2023-05-12
- [CVE-2017-12615](https://access.redhat.com/errata/RHSA-2017:3113), added to CISA KEV 2022-03-25
- [CVE-2017-12617](https://access.redhat.com/errata/RHSA-2017:3113), added to CISA KEV 2022-03-25
- [CVE-2020-1938](https://security.gentoo.org/glsa/202003-43), added to CISA KEV 2022-03-03

Data as of: 2026-10-24 21:52 UTC

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/tomcat · JSON: https://fixedin.dev/tomcat.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt