Apache Tomcat 9.0 end of life
Apache Tomcat 9.0 is scheduled to reach end of life on 31 March 2027, announced by the Tomcat project well in advance of the date. Until then 9.0 continues to receive security and bug-fix releases. After it, the Apache Tomcat project publishes no further releases on the 9.0 line and security vulnerabilities found in it will not be fixed upstream.
- End of life
- 31 March 2027
- Released
- Sept 2017
- Final release
- 9.0.122 (current)
- Successor
- Tomcat 10.1 or Tomcat 11.0
Date published by Apache Tomcat versions page. We do not publish a lifecycle date we cannot source.
What actually stops on 31 March 2027
- Security and bug-fix releases on the 9.0.x line after the final release.
- Apache Software Foundation security advisories covering Tomcat 9, which is what most vulnerability scanners key on.
- Nothing else. Tomcat 9 keeps serving requests; what ends is the fix supply.
What actually breaks in the upgrade
9 to 10.1 is the javax to jakarta rename, and it touches every file
Tomcat 10 onwards implements Jakarta EE, which moved every servlet API package from javax.* to jakarta.*. This is not a configuration change: every import in every servlet, filter, listener and JSP has to move, and every dependency that touches the servlet API has to be on a Jakarta-compatible version. The Tomcat project ships a migration tool that rewrites bytecode at deploy time, which is a genuine bridge, but running production on bytecode rewriting indefinitely is not a strategy.
The migration tool is a real option for buying time
Apache's migration tool for Jakarta EE can convert a javax-based WAR to jakarta at build time or on deployment. For estates with third-party WARs they cannot rebuild, this is often the only viable path, and it is worth prototyping early because it either works cleanly or reveals a blocker immediately.
Eighteen months is the planning window
The date is known and public. The difference between planning the Jakarta migration now and discovering it in early 2027 is the difference between a scheduled project and an emergency one, because the javax to jakarta move is not a task that can be compressed.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Migrate to Tomcat 10.1 or 11 | The javax to jakarta namespace migration, across every servlet-touching dependency. | Weeks to months depending on third-party WARs | Engineering time | The right answer, and the one that needs the most lead time. Start before 2027. |
| Use the Jakarta migration tool | Rewrite javax to jakarta at build or deploy time. | Days to prototype | Engineering time | A genuine bridge, especially for third-party WARs you cannot rebuild. Prove it early. |
| Extended support on Tomcat 9 | Backported CVE fixes on the 9.0 line past March 2027. | Days to onboard | Subscription | Right when the Jakarta migration is a real project that will not finish by the date. |
| Stay on 9 unpatched after the date | No upstream fixes from April 2027. | None | Zero now | Tomcat is usually the internet-facing edge of a Java estate, which makes this the worst place to carry unpatched CVEs. |
What OSSeva does for Apache Tomcat 9.0
OSSeva patches this line
OSSeva backports CVE fixes to Tomcat 8.5 today and will cover the 9.0 line from its March 2027 end-of-life date, delivered as signed builds through your repository manager. Tomcat sits at the edge of most Java estates, so we treat its CVEs as priority backports rather than batching them.
Apache Tomcat extended supportWhat your auditor will say
Tomcat is frequently in the cardholder data environment as the application tier. Requirement 6.3.3 applies directly, and an edge component with unpatched CVEs is the least defensible position in an assessment.
CC7.1. Tomcat CVEs are well publicised and reliably picked up by scanners, so an unpatched instance shows up in evidence whether or not you flag it.
Apache Tomcat 9.0: common questions
When does Apache Tomcat 9 reach end of life?
31 March 2027, as announced by the Apache Tomcat project. Until that date the 9.0 line continues to receive security and bug-fix releases.
Is Tomcat 9 still supported?
Yes, until 31 March 2027. Tomcat 8.5 is the line that is already end of life, having reached it on 31 March 2024.
What is the difference between Tomcat 9 and Tomcat 10?
Tomcat 10 implements Jakarta EE, which renamed every servlet API package from javax.* to jakarta.*. This is the single breaking change and it affects every servlet, filter, listener and JSP, plus every dependency that touches the servlet API.
How do I migrate from Tomcat 9 to Tomcat 10?
Either update every javax.* servlet import to jakarta.* and move all servlet-touching dependencies to Jakarta-compatible versions, or use the Apache migration tool for Jakarta EE to rewrite the bytecode at build or deploy time. Prototype the tool early: for third-party WARs you cannot rebuild it is often the only path.
Can I get security patches for Tomcat 9 after March 2027?
Not from the Apache Software Foundation. Third-party extended support providers including OSSeva backport CVE fixes to end-of-life Tomcat lines; we do this for 8.5 today and will cover 9.0 from its date.
Is Tomcat 8.5 still supported?
No. Tomcat 8.5 reached end of life on 31 March 2024 and the project publishes no further releases on that line.
Still running Apache Tomcat 9.0?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.