According to the GNU license list, Apache License 2.0 is compatible with GPL version 3 but not with GPL version 2. The cause is requirements in Apache 2.0, including patent termination and indemnification terms, that are not in GPLv2. The version suffix on the GPL code decides your answer.
What the GNU list says
The page calls Apache 2.0 a free software license compatible with version 3 of the GNU GPL. It then says it is not compatible with GPL version 2, because of requirements that version lacks, including certain patent termination and indemnification provisions.
The patent term is visible in the Apache text itself: if you start patent litigation claiming the work infringes a patent, the patent licenses granted to you for that work end on the day the lawsuit is filed.
Why the suffix matters
GPL-2.0-only code cannot be combined with Apache 2.0 code in one distributed work under the GNU position. GPL-2.0-or-later code can be used under version 3, which does allow the combination. That is why your SBOM license field needs the exact SPDX identifier, not just "GPL".
If the field reads GPL-2.0-or-later, the combination may be workable under GPLv3 terms for the combined result. If it reads GPL-2.0-only, you have a real conflict to resolve.
The earlier post on GPL-only versus or-later identifiers covers how to read the suffixes.
What the combined result looks like
When you combine permissive Apache code with GPLv3 code and distribute the result, the combined work is governed by GPLv3. The Apache parts keep their own notices. Their own license text still applies to those files. You are not removing the Apache license, you are adding GPLv3 obligations to the whole.
Options when you hit a conflict
- Replace the GPL-2.0-only dependency with an alternative under a compatible license.
- Keep the two in separate programs that communicate in a way that does not form one combined work. The GNU FAQ discusses how communication style affects this for plug-ins.
- Ask the copyright holder about a different license or an exception.
- Do not distribute the combination.
A short routine
- Search the SBOM for GPL-2.0-only components.
- For each, check whether anything under Apache 2.0 is linked with it in a shipped artifact.
- Escalate real conflicts to counsel.
Safeguard's SBOM and dependency scanning supply the component inventory for step 1. You can start with the free scan.
Quick check
Is Apache 2.0 compatible with GPLv3?
Yes, per the GNU license list.
Is it compatible with GPL-2.0-only?
No, according to the same page, because of patent termination and indemnification terms that GPLv2 does not have.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
