Tomcat fails our security scan

Issue

• We ran a security scan and it says we need to upgrade tomcat to acquire vulnerability fixes. Is this true?
• tomcat version is old.
• Why does Red Hat stick to old tomcat version when new and security improved versions are available?
• The server is running Apache Tomcat and is prone to multiple vulnerabilities.