Apache Tomcat 7 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
Apache Tomcat 7 reached end of life on 31 Mar 2021. It no longer receives security fixes.
Support timeline
Official dates from the Apache Tomcat release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 10 Jan 2013 | — |
| End of life | 31 Mar 2021 | 5.4 years ago |
| Latest release | 7.0.109 · 22 Apr 2021 | final |
The cost of staying: CVEs since end of life
77 Apache Tomcat vulnerabilities have been published since 31 Mar 2021. All were fixed in supported branches — 7 received none of them. Source: NVD.
Apache Tomcat CVEs published since 7's EOL, by year
15 of the 77 are rated critical · data refreshed 2026-08-09
Published 18 Nov 2024 · rated critical — fixed in supported branches only, never in 7. Details
Published 17 Dec 2024 · rated critical — fixed in supported branches only, never in 7. Details
Published 20 Dec 2024 · rated critical — fixed in supported branches only, never in 7. Details
Where to go from 7
Recommended target: Apache Tomcat 11.0.
The newest actively supported branch is Apache Tomcat 11.0 (latest release 11.0.24). Review tomcat.apache.org before upgrading.
Frequently asked questions
Is Apache Tomcat 7 still safe to use?
No. Apache Tomcat 7 stopped receiving security fixes on 31 Mar 2021. Since then, 77 Apache Tomcat vulnerabilities have been published and fixed in supported branches — Apache Tomcat 7 received none of those fixes.
Can I still download Apache Tomcat 7?
Yes — the final release (7.0.109) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade Apache Tomcat 7 to?
Upgrade to Apache Tomcat 11.0, the newest actively supported branch.