One of our client's recent security scans has advised that only Tomcat v7.0.60 or later should be used.

They have a purely Windows based implementation and don't use Tomcat for any of the web applications. However, I'm aware that Tomcat is embedded within some of the core Tridion 8.5 functionality (Microservices, CME Search?, etc.).

The Content Delivery third-party JAR file reference page of the online docs references tomcat-embed-core version 8.5.4 and tomcat-embed-core-8.5.5.jar is in the lib directory of the microservices. Is it safe to assume that this (v8.5.x) is the embedded version that is used throughout the Content Delivery and Content Manager stacks?

If not, how can we tell which version of embeddable Tomcat is being used? If needed, how can this be upgraded?

Side note: This is related to my question on disabling SSLv3 for Tridion. It is also partly related to this question: SDL Tridon 2013 SP1 Apache Tomcat 7.0.x Upgrade to 7.0.60

1 Answer 1


There is a hotfix that updates all microservices to use Tomcat version 8.5.13. - see http://csei.sdl.com/hotfixes/#/hotfixes/c, and search for hotfix CD_8.5.0.4115

I'm not sure if the CM uses some Tomcat version internally. I know it uses Solr for Search, but i don't think that uses Tomcat.

  • 4
    Tomcat is embedded in the CMS for SOLR
    – Nuno Linhares
    Oct 30, 2018 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.