Tech Support
Documentation
Login
Contact Us
Get as much time as you need of security patches for Apache Tomcat vulnerabilities from an experienced team.
Endless Lifecycle Support for Apache Tomcat
Keep EOL Apache Tomcat versions secure in Java web application servers
Currently supported versions:
8.5.100+ 9.0.50 9.0.75+ 9.0.83 9.0.87 and 9.0.90
CVE patches for Apache Tomcat 8.5 and 9.0 past end of life. Delivered through your existing package manager. Keep Java web applications running securely without forcing a Tomcat version upgrade.
If It’s Open Source and Not on Our List,
We’re Ready to Support It. Just Ask→
TuxCare keeps you ahead of threats by proactively tracking and patching new CVEs impacting Apache Tomcat. View all security fixes available to date here.
If your Apache Tomcat version has reached the end of support, it no longer receives critical security updates or fixes.
Running an unsupported Tomcat version leaves your applications vulnerable to exploits such as authentication bypasses, session hijacking, and web application attacks – potentially compromising sensitive data.
Tomcat upgrades aren’t just version bumps – they introduce configuration shifts,
servlet API changes, and potential incompatibilities with existing deployments.
Don’t let a forced upgrade break your setup – stay protected with ELS from TuxCare.
With Endless Lifecycle Support,
you can:
Minimize Security Risks
Preserve Compatibility
Avoid code refactoring and keep your Apache Tomcat applications running smoothly for years to come.
Ensure Compliance
Gain 14-day SLAs for security fixes and establish transparency with a detailed SBOM.
Apache Tomcat core components that we currently support:
- Coyote (HTTP connector)
- Catalina (servlet engine)
- Jasper (JSP engine)
- Cluster
Contact us if you need support for
additional components
Why TuxCare?
15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:
Extensive Coverage of Open-Source Technologies
We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.
Efficiencies in Build Chains and Testing
We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.
Identification and Patching of Transitive Dependencies
We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.
Fast and Consistent Delivery of Patches with Supporting SLAs
Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.
We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started
2,700+
Enterprise Clients
70,000+Packages Curated
420,000+
Patches Delivered
14,000+
Vulnerabilities Fixed
11,000+
Kernels Supported
70+
Linux Distro Versions Supported
Long-Term Security After Standard Support Ends
TuxCare ELS continues to deliver enduring security for your distro, language, or software development framework for as many years as your organization requires
CentOS Stream
Endless Lifecycle Support for CentOS Stream 8
End of life: June 2024You can rely on Endless Lifecycle Support for CentOS Stream 8 to continue receiving security updates for as long as you need – so that you have enough time to migrate to another Linux distribution securely.
Learn More
RHEL 7
Endless Lifecycle Support for RHEL 7
End of life: June 2024Secure your RHEL 7 infrastructure beyond the end of life with ELS – an affordable, precision-engineered support solution that delivers ongoing security patches for as long as you need.
Learn More
Oracle Linux 7
Endless Lifecycle Support for Oracle Linux 7
End of life: December 2024Give your team plenty of time to upgrade to Oracle Linux 8 or 9 with ELS for Oracle Linux 7, which continues to deliver security patches for as long as you need at a much more affordable cost than an Oracle Premier Support plan.
Learn More
.NET 6.0
Endless Lifecycle Support for .NET
End of life: November 2024Keep using .NET 6 while continuing to receive security updates on both Windows and Linux, for as many years as you need, so your .NET applications remain secure, stable, and compatible until you’re ready to upgrade.
Learn More
Angular
Endless Lifecycle Support for Angular
End of life: Varies for different versionsNeed more time for a safe and smooth upgrade to the latest Angular version? With ELS from TuxCare, you can maintain the security, stability, and compatibility of your existing Angular applications for as many years as you need.
Learn More
AngularJS
Endless Lifecycle Support for AngularJS
End of life: December 2021Not ready to upgrade your end-of-life AngularJS applications just yet? TuxCare ELS lets you keep them secure, stable, and fully compatible for as long as you need — giving you the breathing room to upgrade when it works for you.
Learn More
CentOS 6
Endless Lifecycle Support for CentOS 6
End of life: December 2020TuxCare’s Endless Lifecycle Support gives you the same official security patches you used to get with CentOS 6, and we’ll continue to provide you with ongoing security support for as many years as you need.
Learn More
CentOS 7
Endless Lifecycle Support for CentOS 7
End of life: June 2024CentOS 7 is going end of life in June 2024, but you can enjoy ongoing security updates for as long as you need with our Extended Lifecycle Support – buying time to plan your migration, while keeping your workload safe.
Learn More
RHEL 7
Endless Lifecycle Support for RHEL 7
End of life: June 2024Secure your RHEL 7 infrastructure beyond the end of life with ELS – an affordable, precision-engineered support solution that delivers ongoing security patches for as long as you need.
Learn More
RHEL 7
Endless Lifecycle Support for RHEL 7
End of life: June 2024Secure your RHEL 7 infrastructure beyond the end of life with ELS – an affordable, precision-engineered support solution that delivers ongoing security patches for as long as you need.
Learn More
OpenJDK
Endless Lifecycle Support for OpenJDK
End of life:Keep your Java workloads secure on an out-of-support OpenJDK version – skipping the grind of full QA retest cycles and upgrade-induced breaking changes.
Learn More
Oracle Linux 6
Endless Lifecycle Support for Oracle Linux 6
End of life: March 2021TuxCare will deliver Extended Lifecycle Support for Oracle Linux 6 for as many years as you need, saving you significantly on costs compared to Oracle Linux Premier Support while providing the same vulnerability coverage.
Learn More
PHP
Endless Lifecycle Support for PHP
End of life:Buy yourself and your organization time to develop new production code while receiving ongoing security patches for out-of-support PHP versions with Endless Lifecycle Support to maintain the safety of your systems.
Learn More
Python
Endless Lifecycle Support for Python 2.x
End of life: January 2020Python Extended Lifecycle Service from TuxCare breathes new life into code written for Python 2.7 so you can continue using your existing software on AlmaLinux, Rocky, or Red Hat Enterprise Linux 9 as before.
Learn More
Ubuntu 16.04
Endless Lifecycle Support for Ubuntu 16.04
End of life: April 2021Save on costs compared to Ubuntu Pro for Ubuntu 16.04 when you choose TuxCare Endless Lifecycle Support for ongoing security maintenance, which will keep you protected for as many years as you need beyond the end-of-life date.
Learn More
Ubuntu 18.04
Endless Lifecycle Support for Ubuntu 18.04
End of life: June 2023Choose TuxCare for Ubuntu 18.04 endless support and save significantly over an Ubuntu Pro subscription from Canonical, with security updates for your Ubuntu workloads lasting as long as you need.
Learn More
Ubuntu 20.04
Endless Lifecycle Support for Ubuntu 20.04
End of life: End of Life: May 2025Continue safely working with Ubuntu 20.04 for as many years as you’d like, with TuxCare delivering ongoing security updates to protect your systems for as long as your organization needs.
Learn More
CentOS 8
Extended Lifecycle Support for CentOS 8
End of life: December 2021All the way through January 2026, you can rely on TuxCare for Extended Lifecycle Support to cover security updates for your CentOS 8 Linux distribution – so that you have enough time to migrate to another distro.
Learn More
RHEL 7
Endless Lifecycle Support for RHEL 7
End of life: June 2024Secure your RHEL 7 infrastructure beyond the end of life with ELS – an affordable, precision-engineered support solution that delivers ongoing security patches for as long as you need.
Learn MoreFrequently Asked Questions
Tomcat 7.0 ended in March 2021 and Tomcat 8.5 ended March 31, 2024. Once a branch retires, the Apache Tomcat project publishes nothing further for it, security releases included. ELS for Apache Tomcat continues patching retired branches and specific pinned builds.
Tomcat 7.0.109, 8.5.100, 9.0.46, 9.0.50, 9.0.75, 9.0.83, 9.0.87, 9.0.90, 9.0.100, 10.1.18, and 10.1.42 — covering both fully retired branches and specific pinned 9.0.x and 10.1.x builds that teams can't move off. Patches target core components including Catalina, Coyote, and Jasper.
Yes. Unsupported middleware is a standing finding under PCI DSS, HIPAA, and FedRAMP. ELS keeps CVEs closed in the version you run, and the 14-day target for CVSS 7.0+ fixes sits inside PCI DSS's 30-day remediation requirement.
Yes. Patches apply within the same Tomcat version, so connector tuning, valves, realms, custom server.xml, and deployed WARs stay as they are — exactly what a major-version jump puts at risk.
Yes. Tomcat ships both as a standalone server and as library artifacts. Server builds come from TuxCare's Nexus els_java repository as .tar.gz for Linux or .zip for Windows; Maven and Gradle projects resolve the same patched artifacts as dependencies, which covers embedded Tomcat in Spring Boot-style applications.
No. Installation needs JDK 7 or later with JAVA_HOME set — the JDK your application already uses. If that JDK is itself out of support, ELS for OpenJDK covers 7, 8, 11, and 17.