Apache Tomcat End of Life —
9 is supported until at least March 2027; 8.5 and 10.0 are dead
Quick answer: three Tomcat branches are supported today — 11.0.x (current), 10.1.x, and 9.0.x. Neither 11.0 nor 10.1 has an announced end-of-support date. For 9.0.x the Apache Tomcat project says end of support is expected no earlier than March 31, 2027 — so Tomcat 9 is not end of life, whatever a scanner or an older article says. The lines that are dead: Tomcat 8.5 (March 31, 2024), 10.0 (October 31, 2022), 8.0 (June 30, 2018), 7.0 (March 31, 2021).
Key Dates at a Glance
- Tomcat 9.0.x: end of support expected no earlier than 2027-03-31
- Tomcat 10.1.x: no end-of-support date announced (released 2022-09-23)
- Tomcat 11.0.x: no end-of-support date announced (released 2024-10-03)
- Tomcat 10.0.x: end of life 2022-10-31
- Tomcat 8.5.x: end of life 2024-03-31
- Tomcat 8.0.x: end of life 2018-06-30
Tomcat EOL Risk Scores
An end-of-life date on its own does not tell you how urgent a version is. We publish an EOL Risk Score (0–100) for every tracked version, combining how long past — or how close to — end of life it is, the attack surface of the software class, whether CISA lists the product in its Known Exploited Vulnerabilities catalog, and whether commercial extended support exists. Tomcat is an internet-facing servlet container that appears in the KEV catalog, so supported branches start from an elevated baseline.
| Branch | EOL Risk Score | What drives it |
|---|---|---|
| Tomcat 8.0 | 80 | End of life June 30, 2018 — recency at maximum; container attack surface; KEV exposure. |
| Tomcat 8.5 | 80 | End of life March 31, 2024; the most common dead Tomcat still in production. |
| Tomcat 9.0 | 40 | Supported until at least March 31, 2027; the supported-container baseline. |
| Tomcat 10.1 | 40 | Supported, no end date announced. |
| Tomcat 11.0 | 40 | Current release, no end date announced. |
Scores update automatically at every site build; every branch is on the Tomcat product page and the methodology on the EOL Risk Score page.
Complete Apache Tomcat Support Schedule
| Branch | Spec | Released | End of support | Status (Aug 2026) |
|---|---|---|---|---|
| Tomcat 11.0.x | Jakarta EE 11 / Servlet 6.1 | Oct 3, 2024 | Not announced | Supported |
| Tomcat 10.1.x | Jakarta EE 10 / Servlet 6.0 | Sep 23, 2022 | Not announced | Supported |
| Tomcat 9.0.x | Java EE 8 / Servlet 4.0 (javax.*) | Sep 27, 2017 | No earlier than Mar 31, 2027 | Supported |
| Tomcat 10.0.x | Jakarta EE 9 / Servlet 5.0 | Dec 3, 2020 | Oct 31, 2022 | EOL |
| Tomcat 8.5.x | Java EE 7 / Servlet 3.1 | Mar 17, 2016 | Mar 31, 2024 | EOL |
| Tomcat 8.0.x | Java EE 7 / Servlet 3.1 | Jan 29, 2014 | Jun 30, 2018 | EOL |
| Tomcat 7.0.x | Java EE 6 / Servlet 3.0 | 2011 | Mar 31, 2021 | EOL |
| Tomcat 6.0.x | Java EE 5 / Servlet 2.5 | 2007 | Dec 31, 2016 | EOL |
Apache announces the end of a branch with at least twelve months' notice; the project has also signalled a future 9.1.x branch (Java EE 8 API on newer Java) whose lifecycle is not yet determined. When any of these dates is published it will appear here and on the product page automatically.
Tomcat 9.0 — Supported Until at Least March 31, 2027
Tomcat 9.0.x (released September 27, 2017) is the last branch on the javax.* namespace, which is exactly why it is still supported and still everywhere: every application built against Java EE 8 / Servlet 4.0 runs on it unchanged, and moving off it means the Jakarta namespace migration below. It receives security fixes today. Plan against March 31, 2027 as the earliest possible end, watch for Apache's announcement, and use the time to run the migration on your own schedule rather than under a deadline.
Tomcat 10.0 and 10.1 — One Dead, One Supported
Tomcat 10.0.x was the first Jakarta EE (9) branch and was retired quickly on October 31, 2022 once 10.1 shipped; anything still on 10.0 should move to 10.1 (a small hop) immediately. Tomcat 10.1.x (Jakarta EE 10 / Servlet 6.0, released September 23, 2022) is fully supported with no announced end date and is the natural landing zone for applications that have completed the jakarta.* migration but are not ready for Tomcat 11's Java 17 baseline.
Tomcat 11.0 — Current Release
Tomcat 11.0.x (Jakarta EE 11 / Servlet 6.1, released October 3, 2024) is the current branch, requires Java 17 or later, and is where new features land. No end-of-support date is announced. New deployments should start here.
Tomcat 8.5 and Older — End of Life
Tomcat 8.5.x reached end of support on March 31, 2024 and is the most common dead Tomcat found in production scans; 8.0.x ended June 30, 2018, 7.0.x March 31, 2021, 6.0.x December 31, 2016. None receives security fixes. The good news for 8.5 estates: Tomcat 9.0 is a drop-in upgrade for javax.* applications, so the move off a dead branch does not require the Jakarta migration — that can follow later.
How to Check Your Tomcat Version
bin/version.sh(orversion.bat) in the Tomcat installation — prints the exact server number and the JVM.- The startup banner in
catalina.out; orServletContext.getServerInfo()from inside an application. - Embedded Tomcat (Spring Boot): the
tomcat-embed-coreversion in your dependency tree — Spring Boot 3.x embeds Tomcat 10.1, Spring Boot 4.x embeds Tomcat 11.
The first two numbers (8.5, 9.0, 10.1, 11.0) are the branch that decides support status. The EOL Checker maps a version to its status; the Stack Scanner flags Tomcat alongside the JDK and framework layers that each have their own clock.
What Happens When a Tomcat Branch Reaches End of Support
Nothing stops — and that is the problem. Tomcat is the process listening on the port; every request-parsing, session-handling and file-serving vulnerability disclosed after the date stays open on it, and Tomcat CVEs are a regular presence in CISA's Known Exploited Vulnerabilities catalog. Vulnerability scanners often miss it because they check CVE version ranges that do not enumerate the dead build — the CVE blind spot. Compliance frameworks treat an unsupported servlet container as a control failure.
Your Options on an End-of-Life Tomcat
- 8.5 or older → 9.0. Drop-in for
javax.*applications; buys you until at least March 2027 with no code changes. - 9.0 → 10.1 or 11.0. The Jakarta namespace migration below; do it on your schedule before Apache's 9.0 announcement forces it.
- Extended support. Independent vendors sell security patches for retired Tomcat branches (8.5, 7.0) for applications that cannot move yet; see extended support options.
Migrating from Tomcat 9 to Tomcat 10.1/11.0
Step 1 — Run the Jakarta EE migration tool
The official Apache migration tool scans your WAR or exploded application and rewrites javax.* imports to jakarta.* automatically. Run it on your application before attempting to deploy to Tomcat 10+.
Step 2 — Update your dependencies
Third-party libraries that reference javax.servlet must be updated to versions compiled against jakarta.servlet. Spring Framework 6+, Hibernate 6+, and Jakarta EE 10-compatible libraries are required. Check each dependency's Jakarta EE compatibility matrix.
Step 3 — Test in a staging environment
Deploy to Tomcat 11 in a staging environment and run your full integration test suite. Pay particular attention to servlet filters, session listeners, and any code that touches HttpServletRequest or HttpServletResponse directly.
Step 4 — Update your deployment configuration
Review web.xml, context.xml, and Tomcat's server.xml for deprecated settings. Tomcat 11 removed support for some legacy configuration options that were deprecated in Tomcat 9 and 10.
Apache Tomcat currently carries an EOL Risk Score™ of 80/100 — Grade D, high risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the Apache Tomcat lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
Frequently Asked Questions
Is Apache Tomcat 9 end of life?
No. The Apache Tomcat project states that end of support for Tomcat 9.0.x is expected no earlier than March 31, 2027, and 9.0.x still receives security fixes. Anything you read saying Tomcat 9 died in 2025 is wrong. Tomcat 8.5.x (ended March 31, 2024) and 10.0.x (ended October 31, 2022) are the recent lines that are actually end of life.
Which Tomcat versions are supported right now?
Tomcat 11.0.x (current, Jakarta EE 11 / Servlet 6.1), Tomcat 10.1.x (Jakarta EE 10 / Servlet 6.0) and Tomcat 9.0.x (Java EE 8 / Servlet 4.0, javax.* namespace). Neither 11.0 nor 10.1 has an announced end-of-support date; 9.0's is no earlier than March 31, 2027.
When does Tomcat 10.1 reach end of life?
No date has been announced. Apache typically announces end of support for a Tomcat branch with at least twelve months' notice; when a 10.1.x date is published we will add it here and to the Tomcat 10.1 product page.
Is Tomcat 8.5 still supported?
No. Tomcat 8.5.x reached end of support on March 31, 2024 (Tomcat 8.0.x on June 30, 2018, 7.0.x on March 31, 2021, 6.0.x on December 31, 2016). Anything on 8.5 or older receives no security fixes and should move to 9.0 (drop-in for javax.* applications) or 10.1/11.0.
Why can't I just upgrade Tomcat 9 to Tomcat 10 or 11?
Because Tomcat 10 and later implement Jakarta EE, which renamed the javax.* packages to jakarta.*. An application compiled against javax.servlet will not deploy unchanged on 10.1 or 11.0; it must be migrated (Apache's migration tool rewrites most of it) or run on 9.0.x, which is why 9.0.x has such a long tail.
How do I check my Tomcat version?
Run bin/version.sh (or version.bat) in the Tomcat installation, look at the server banner in catalina.out at startup, or read the Server header if it is exposed. In Java, ServletContext.getServerInfo() returns the version. The first two numbers (8.5, 9.0, 10.1, 11.0) are the branch that decides the support status.
Related Resources
- Tomcat product page — live status, dates and risk scores for every branch
- Spring Boot end of life · Spring Framework end of life — the frameworks that embed Tomcat
- Java end of life by vendor — the JDK underneath
- EOL Watch · EOL Checker · EOL Risk Score methodology