Does Spring Boot include Apache Tomcat example applications in the packaged build?

Products

• VMware Tanzu Application Platform
• VMware Tanzu Platform Spring
• VMware Tanzu Platform Spring Essentials
• VMware Tanzu Spring Essentials
• VMware Tanzu Spring Runtime
• VMware Tanzu Spring Runtime - SM

Issue/Introduction

Customers often ask if Spring Boot applications are vulnerable to threats associated with default Apache Tomcat applications, such as the examples folder, because security scanners or internal policies may flag these files in standard Tomcat distributions.

Environment

All Spring Boot versions using embedded Tomcat.

Resolution

No, Spring Boot does not include Apache Tomcat example applications.

Spring Boot is designed to run as a standalone application. It achieves this by using Embedded Tomcat, which incorporates only the necessary libraries (e.g., tomcat-embed-core, tomcat-embed-el) required to start and run the application.

It does not include the full Apache Tomcat server distribution. The "examples" application folder, manager web application, and other default utilities that ship with a standard Apache Tomcat installation are excluded from the Spring Boot embedded dependencies.

If your security team is concerned about the presence of these files, you can confirm that they are not bundled with your Spring Boot application build.

Additional Information

• How Spring Boot uses Tomcat: Spring Boot treats Tomcat as a dependency library, not a standalone server installation.
• Security Scanning: If security scanners are flagging "Tomcat examples" within your environment, ensure that you are scanning the application JAR/WAR package itself rather than the host environment, as the host environment might contain other installations of Tomcat that are independent of your Spring Boot application.