Apache Tomcat: keep it patched (supported versions and updates)

Updated November 2026

Run Tomcat 11.0, 10.1 or 9.0 at the latest patch release: 11.0.27, 10.1.61 or 9.0.123, all released October 12, 2026. They fix three Important flaws made public on October 20, including a JNDIRealm (LDAP login) authentication bypass that affects every 9.0, 10.1 and 11.0 release before them.

11.0.27Latest Tomcat 11 (Java 17+)
10.1.61Latest Tomcat 10.1 (Java 11+)
9.0.123Latest Tomcat 9 (Java 8+)
Mar 31, 2027End of support for Tomcat 9.0

What it is

Apache Tomcat is a Java servlet container: it runs Java web applications (WAR files) that use the Jakarta Servlet, Pages (JSP), WebSocket and related specifications. It often sits behind Apache httpd or nginx, and it is embedded in many vendor products. Tomcat runs on the JVM, so patching it also means patching Java.

Supported versions

Apache Tomcat branches as of November 3, 2026
Branch	Platform	Minimum Java	Latest	Support
11.0	Jakarta EE 11	17	11.0.27	Supported
10.1	Jakarta EE 10	11	10.1.61	Supported
9.0	Java EE 8	8	9.0.123	Ends Mar 31, 2027
10.0	Jakarta EE 9	8	10.0.27	Ended Oct 31, 2022
8.5	Java EE	7	8.5.100	Ended Mar 31, 2024
7.0	Java EE	6	7.0.109	Ended Mar 31, 2021

The Tomcat project does not publish binary patches for single flaws. To get a fix, you upgrade to the release that contains it. Tomcat Native 1.3.x, the older APR/OpenSSL library, also reaches end of support on March 31, 2027; Tomcat Native 2.0.17 and 1.3.10 came out on October 29, 2026.

October 2026 fixes

Fixed in 11.0.27, 10.1.61 and 9.0.123 (public October 20, 2026)
CVE	Rating	Problem	Branches
CVE-2026-101296	Important	JNDIRealm with a non-GSSAPI SASL mechanism could let attackers log in without valid credentials	11.0, 10.1, 9.0 (all releases)
CVE-2026-101356	Important	HTTP/2 request/response mix-up between users after an async error	11.0.22+, 10.1.55+, 9.0.118+
CVE-2026-103119	Important	AJP response body split into the next request, possible data leak	11.0 only
CVE-2026-93446, -88041, -74049, -74048	Low	TLS 1.3 failures, HTTP/2 trailer mix-up, JSTL redirect, FIPS start-up	all three

The September releases (11.0.26, 10.1.60, 9.0.122) fixed another Important request-header mix-up, CVE-2026-86350. Per-CVE details are on our vulnerability pages.

Check the installed version

$CATALINA_HOME/bin/version.sh                       # upstream tarball, e.g. /opt/tomcat/bin/version.sh
/usr/share/tomcat10/bin/version.sh                  # Debian/Ubuntu tomcat10 package
java -cp /usr/share/tomcat10/lib/catalina.jar org.apache.catalina.util.ServerInfo
dpkg -l 'tomcat*' | grep ^ii                        # Debian/Ubuntu packages
rpm -qa 'tomcat*'                                   # RHEL/Fedora/SUSE
ps -eo pid,lstart,args | grep '[c]atalina'          # running instances and start time

The ps output shows -Dcatalina.home= and -Dcatalina.base= for each instance, so you can find copies you did not know about, including Tomcat bundled inside other products. See Check installed versions.

Distro packages vs upstream

Distributions keep one Tomcat version per release and backport fixes. Backports can be slow: on November 3, the Debian tracker listed the October CVEs as open for tomcat10 (10.1.55) in Debian 12 and 13 and tomcat11 (11.0.22) in Debian 13. Ubuntu 24.04 and 26.04 also had 10.1.55 in their updates archives. RHEL 10's Tomcat 9 application stream retired in May 2026. FreeBSD ports were current: www/tomcat110 11.0.27 and www/tomcat101 10.1.61.

sudo apt update && sudo apt install --only-upgrade 'tomcat*' 'libtomcat*'   # Debian/Ubuntu
sudo dnf upgrade --refresh 'tomcat*'                                       # RHEL family/Fedora
sudo zypper patch                                                          # SUSE
sudo pkg upgrade tomcat110                                                 # FreeBSD (or tomcat101, tomcat9)

If your distro's package still has an Important flaw that affects your setup, use the upstream release (below) for that service until the backport arrives. Alpine has no Tomcat package in its main repositories; use the tarball or the Docker image.

Update an upstream install

Keep the Tomcat binaries (CATALINA_HOME) apart from your configuration and apps (CATALINA_BASE, with conf/, webapps/, logs/). Then an update is just a new CATALINA_HOME. Example for 11.0.27, with the service's base in /var/lib/tomcat:

V=11.0.27
cd /tmp
curl -fLO https://dlcdn.apache.org/tomcat/tomcat-11/v$V/bin/apache-tomcat-$V.tar.gz
curl -fLO https://dlcdn.apache.org/tomcat/tomcat-11/v$V/bin/apache-tomcat-$V.tar.gz.sha512
sha512sum -c apache-tomcat-$V.tar.gz.sha512
sudo tar --no-same-owner -xzf apache-tomcat-$V.tar.gz -C /opt
sudo -u tomcat env CATALINA_HOME=/opt/apache-tomcat-$V CATALINA_BASE=/var/lib/tomcat \
  /opt/apache-tomcat-$V/bin/configtest.sh            # test config with the new version
sudo ln -sfn /opt/apache-tomcat-$V /opt/tomcat       # systemd unit uses /opt/tomcat
sudo systemctl restart tomcat.service                # restarts Tomcat (brief outage)

Use tomcat-10 and tomcat-9 in the URL for the other branches. Read the changelog first: patch releases sometimes tighten defaults. Keep the old directory until the new one has run cleanly, so you can switch the link back.

Docker image

The official tomcat image has tags per branch and Java version, such as 11.0-jre21-temurin, 10.1-jre21 and 9.0-jre21. Pin the branch and rebuild so you get both the Tomcat and the Java fixes:

docker build --pull -t myapp:latest .
docker compose build --pull && docker compose up -d     # recreates containers
docker compose exec app /usr/local/tomcat/bin/version.sh

Restart and verify

Tomcat must restart to load new code; there is no graceful reload of the server itself. Test the configuration first, then restart and check the logs:

sudo -u tomcat env CATALINA_BASE=/var/lib/tomcat10 /usr/share/tomcat10/bin/configtest.sh   # Debian/Ubuntu
sudo systemctl restart tomcat10                           # restarts Tomcat (Debian/Ubuntu service name)
sudo journalctl -u tomcat10 --since '10 min ago' | grep -E 'Server version|SEVERE'
ps -eo pid,lstart,args | grep '[c]atalina'

At start-up Tomcat logs a "Server version name" line with the exact release. Also open the app's health page. If the line is not in the journal, look in /var/log/tomcat10/ (Debian/Ubuntu) or $CATALINA_BASE/logs/ (upstream installs). More in Restarts and reboots.

Security advisories

Fixed flaws per branch: Tomcat 11, Tomcat 10, Tomcat 9.
The low-volume announce list, announce@tomcat.apache.org (subscribe by mailing announce-subscribe@tomcat.apache.org), carries all releases and security announcements; the archive is public.
Report new flaws privately to security@tomcat.apache.org. For distro packages, watch your distribution's tracker. See Security advisories.

Hardening tips

Run Tomcat as a dedicated user, never root. Keep files owned by root with group tomcat, and give the Tomcat user write access only to logs, temp and work.
Remove the examples and docs apps and the default ROOT app from public instances.
If you need manager or host-manager, restrict them with RemoteCIDRValve (for example allow="127.0.0.1/8,::1/128"), use strong passwords and keep LockOutRealm.
Disable the shutdown port with port="-1" on the <Server> element.
Remove unused connectors. If you must use AJP, bind it to address="127.0.0.1" or a trusted network and set secret (called requiredSecret before 9.0.31).
Hide version details: ErrorReportValve with showReport="false" and showServerInfo="false".
Set autoDeploy="false" and deployOnStartup="false" in production, and keep the DefaultServlet's readonly at true and listings at false.
Enable the AccessLogValve and send logs to your monitoring.

On an end-of-life branch

Tomcat 8.5, 8.0, 7.0 and older are end of life and get no fixes. Moving to 9.0 keeps the javax.* APIs but buys you only until March 31, 2027. Tomcat 10.1 and 11 use the jakarta.* package names, so apps usually need changes; the Apache Tomcat Migration Tool for Jakarta EE converts them, and Tomcat 10.1 converts WARs placed in $CATALINA_BASE/webapps-javaee automatically. Test on a staging server, then switch. See Is my OS supported?.