Hazelcast Platform End of Life (EOL) Dates & Support Timeline

Hazelcast Platform lifecycle status — the real story

Hazelcast is the in-memory data grid wired into trading platforms, fraud-detection pipelines, and session stores where microseconds matter — which is exactly why its versions outlive their support windows: nobody wants to restart the cluster that holds the order book. Hazelcast's published policy gives each minor release two years of standard support from GA, followed by 18 months of extended support (guidance, but no further patches). The dates in this table are computed from that policy and each line's actual GA date; Hazelcast publishes the policy itself in its Version Support Windows article rather than a per-version date table.

The platform's history splits at version 5.0 (September 2021), when Hazelcast IMDG and the Jet stream-processing engine merged into a single product, “Hazelcast Platform.” Anything still on IMDG 3.12 or 4.x is two product generations back — 3.12's final patch shipped in August 2022 — yet those lines remain common in production precisely because they sit under systems too critical to touch. From 5.5 (July 2024) Hazelcast moved to an LTS model: 5.5 was the first long-term-support release, with short-term releases in between, and its standard-support window closed in July 2026 under the two-year policy.

In practice Hazelcast has occasionally shipped patches slightly outside the policy windows (3.12 received fixes into its extended period), so treat the dates here as the vendor's commitment floor, not a prediction of the last binary. Commercial extended support for end-of-life Hazelcast lines exists beyond the vendor's own windows — see the support options below.

What does Hazelcast Platform end of life mean for your organization?

When a version of Hazelcast Platform reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.

The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.

Organizations running EOL Hazelcast Platform should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.

Extended Support Options

If you cannot migrate immediately, extended support vendors provide continued security patches for EOL Hazelcast Platform versions. This is a bridge, not a permanent solution — plan your migration in parallel.

Related Products