Apache projects: Tomcat, Kafka, Spark, Cassandra and more

Updated November 2026

The Apache HTTP Server was the first project of what became the Apache Software Foundation, which now hosts hundreds of open-source projects. These pages explain the ones you are most likely to meet next to a web server: what each does, the current versions as of November 2026, how to try it, and how to keep it patched.

What each page covers

Every project page follows the same pattern, so you can compare them quickly:

• What the software is and what people use it for
• How it works, in plain words, with the parts you will see in logs and configuration
• Supported versions, taken from the project's own download or release pages
• Install commands for a test machine, with checksum verification
• Upgrade notes and where the project publishes security advisories

Current versions at a glance

Rules that apply to all of them

• Download from the project's own page. Apache releases are served from dlcdn.apache.org and downloads.apache.org; old releases move to archive.apache.org. Each file comes with a .sha512 checksum and an .asc signature you can check against the project's KEYS file.
• Support windows differ. Tomcat names end-of-support dates per branch, Kafka supports its three most recent release lines, Spark sets maintenance periods by release type, and Cassandra maintains a line until a later major version ships. Never assume one project's rule applies to another.
• Distribution packages are a valid choice. Debian, Ubuntu and RHEL often ship older version numbers with security fixes backported. Follow the distribution's security tracker if you use their packages, and the project's advisories if you use upstream tarballs.
• Security advisories. The ASF security team lists every project's security contact and advisory page at security.apache.org/projects. Undisclosed vulnerabilities go privately to the project's address, or to security@apache.org if it has none.
• Licenses. All ASF projects are released under the Apache License 2.0; see the Apache License explained.

All project pages

• TomcatApache Tomcat explained: the 11.0, 10.1 and 9.0 branches (November 2026), Tomcat 9 end of support, installing it, and putting it behind Apache httpd safely.
• KafkaApache Kafka explained: topics, brokers and KRaft controllers, the supported 4.4, 4.3 and 4.2 releases (November 2026), a quickstart, and the path off ZooKeeper.
• SparkApache Spark explained: driver, executors and cluster managers, the 4.3.0 release and maintained lines (November 2026), a local install, and security defaults.
• CassandraApache Cassandra explained: the token ring, replication and tunable consistency, the maintained 5.0, 4.1 and 4.0 lines (November 2026), install and security.
• Lucene and SolrApache Lucene and Solr explained: how they fit together, current versions (Lucene 10.6.0, Solr 10.1.0, November 2026), how to try Solr, and how to secure and upgrade it.
• AirflowWhat Apache Airflow does, how its scheduler, Dag processor, API server and workers fit together, current release 3.3.2 (November 2026), install steps and upgrade rules.
• Log4jLog4Shell (CVE-2021-44228) and its follow-up CVEs with fixed versions, current Log4j 2.26.1 (November 2026), Log4j 1.x end of life, and commands to find vulnerable jars.
• Apache License 2.0What the Apache License 2.0 allows, what it requires (license copy, change notices, NOTICE file), how the patent grant works, and why it fits GPLv3 but not GPLv2.

Sources

• ASF Security Team, Apache Software Foundation
• Security contacts and advisories for Apache projects, ASF Security Team
• Which version do I want?, Apache Tomcat
• Downloads, Apache Kafka
• Versioning policy, Apache Spark
• Downloads, Apache Cassandra
• Solr Downloads, Apache Solr
• Lucene Downloads, Apache Lucene
• Supported versions, Apache Airflow documentation
• Release notes, Apache Log4j