Overview
end-of-life.org is a reference site for software and hardware end-of-life (EOL) dates. At the time of writing it tracks 484 products and 9,187 release branches across nine categories: languages and runtimes, frameworks, databases, server applications, applications, operating systems, services, devices and standards. The data is rebuilt every day, and each page shows the date of the last refresh.
Most EOL trackers stop at the date. end-of-life.org adds a second number for a subset of products: how many vulnerabilities have been published since a version went end of life and were fixed only in newer branches. The site calls this "CVEs missed". For example, the Python 3.8 page shows that the branch reached end of life on 7 Oct 2024 and that 16 Python CVEs have been published since then, none of which were fixed in 3.8. The homepage ranks the riskiest EOL versions still likely to be in use by this count, with MySQL 5.7, Go 1.16 and Go 1.17 near the top.
The CVE layer currently covers 13 products: Django, VMware ESXi, Go, Keycloak, MySQL, Node.js, PHP, PostgreSQL, Python, Ruby on Rails, Ruby, Spring Boot and Apache Tomcat. The site explains why it is limited to these: for Linux distributions that backport fixes, or for hardware with no comparable vulnerability stream, "the new version got the fix, the old one didn't" would not be true, so those products get lifecycle dates only.
Key Features
- EOL dates for 484 products. Each product page lists every release branch with its release date, end of active support, end of security support, current status and latest release.
- CVEs missed since EOL. For 13 products, each end-of-life branch shows a count of NVD vulnerabilities published after its EOL date and fixed only in supported branches, with a by-year chart and individual CVE entries including CVSS score and severity.
- Version detail pages. Pages such as /python/3.8/ show days without security patches, a support timeline, the CVEs missed, a recommended upgrade target, a command to check your installed version, and a short FAQ ("Is Python 3.8 still safe to use?").
- Riskiest EOL versions ranking. The homepage ranks versions that went end of life within the last five years by CVEs missed, leaving out very old branches that few people still run.
- Expiring in the next 90 days. The /expiring/ page lists every branch losing support in the next 90 days (201 branches across 118 products at the time of writing), grouped by month with days remaining and category.
- Lifecycle timeline charts. Product pages include a visual timeline showing which branches are supported, in security-fixes-only mode, or end of life.
- Search. Queries such as "php 7.4", "ubuntu 20.04" or "windows server" go straight to the relevant product or version.
- Free JSON API. Static JSON endpoints for all products and for each product, with no key, no signup and no rate limit, open CORS, and a generated_at timestamp on every response.
- Documented data sources. A methodology page explains where every date comes from and what the site refuses to do, such as inventing day-level precision for month-only announcements.
Use Cases
- Checking whether a version is still supported. Look up a runtime, database or OS version and see its security support end date and status.
- Making the case for an upgrade. A count such as "16 CVEs published since EOL, none fixed in this branch" is easier to bring to a manager or change board than a date alone.
- Planning maintenance windows. The 90-day expiring list shows which branches stop receiving fixes soon, so upgrades can be scheduled before the deadline.
- Choosing an upgrade target. Version pages name the newest actively supported branch and how long it is supported.
