Our policy is to maintain a release (ie, release bug fix versions and communicate about security vulnerabilities) for 6 months after the next ESR version is announced. This gives you a 6 month window to upgrade. For example, as Rudder 2.11.x was announced as an ESR in June 2015, and Rudder 3.1 was announced as an ESR in March 2016, Rudder 2.11.* was maintained until September 2016 (March 2016 + 6 months).
See the status of past and current releases in the dedicated page.
Customer support service by UserEcho