Apache Tomcat 9.0 End of Life
Support dates, the patch stream you lose at EOL, and upgrade guidance — rebuilt from live data.
Apache Tomcat 9.0 is actively supported. It reaches end of life on 31 Mar 2027.
Support timeline
Official dates from the Apache Tomcat release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 27 Sept 2017 | — |
| End of life (scheduled) | 31 Mar 2027 | in 234 days |
| Latest release | 9.0.120 · 3 Jul 2026 | current |
What you lose on 31 Mar 2027
Being supported means fixes keep shipping to this branch. Here is the stream that stops. Source: NVD.
Apache Tomcat CVEs published and patched, by year
35 published in the last 12 months · data refreshed 2026-08-09
At the last-12-month rate of 35 Apache Tomcat CVEs, running 9.0 for a year past 31 Mar 2027 means roughly that many vulnerabilities fixed upstream but never backported to your branch. Past branches bear this out: Apache Tomcat 10.0 has missed 67 since it went end of life.
How much runway a newer branch buys
Apache Tomcat 9.0 is the newest branch — this is the longest runway currently available.
| Branch | End of life | Days left | vs 9.0 |
|---|---|---|---|
| Apache Tomcat 9.0 | 31 Mar 2027 | 234 | this branch |
Review tomcat.apache.org before moving to Apache Tomcat 11.0.
Frequently asked questions
When does Apache Tomcat 9.0 reach end of life?
Apache Tomcat 9.0 reaches end of life on 31 Mar 2027 — 234 days from now. After that date it receives no security fixes.
Is Apache Tomcat 9.0 still supported?
Yes. Apache Tomcat 9.0 is currently maintained. Latest release: 9.0.120, published 3 Jul 2026.
What happens when Apache Tomcat 9.0 reaches end of life?
Security fixes stop. Over the last 12 months 35 Apache Tomcat vulnerabilities were published and patched across supported branches; once 9.0 is end of life, fixes at that rate no longer reach it.
How long do I have to upgrade from Apache Tomcat 9.0?
234 days. This is already the newest branch, so this is the longest runway currently available.