Apache Tomcat 8.5.100 Actively exploited

Attackers are using a vulnerability in this version right now. Upgrade immediately.

Upgrade to 9.0.123

The lowest fixed release that is still supported.

Known vulnerabilities

59 (17 critical, 30 high)

End of life

Yes, since 2024-03-31

Data as of

2026-10-24 20:37 UTC

Vulnerabilities

• CVE-2025-24813 critical exploited
• CVE-2026-76183 critical
• CVE-2026-65905 critical
• CVE-2026-43512 critical
• CVE-2026-41293 critical
• CVE-2025-31651 critical
• CVE-2024-56337 critical
• CVE-2024-52316 critical
• CVE-2024-50379 critical
• CVE-2025-55754 critical

And 49 more with lower severity.

• 9 Apache Tomcat vulnerabilities are still under review and not included in this verdict.

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.