...
For Admin Interface clients / proxies that are exposed to the internet it is crucial that the highest/securest version of Tomcat is used. The highest version most commonly contains security fixes of common vulnerabilities and exposures (CVEs). Any version of Tomcat can (in general) always be made to work with our Admin Interface / HttpProxy / ArchiveServer as long as provided that the correct Java version is used, matching the indicated JRE version for the Delft-FEWS release version is used and is compatible with the Tomcat distribution.
See http://tomcat.apache.org/security-9.html
...